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Summary 



Just like we can divide the set of bipartite quantum states into separable states 
and entangled states, we can divide it into states with and without a symmetric 
extension. The states with a symmetric extension — which includes all the separa- 
ble states — behave classically in many ways, while the states without a symmetric 
extension — which are all entangled — have the potential to exhibit quantum effects. 
The set of states with a symmetric extension is closed under local quantum oper- 
ations assisted by one-way classical communication (1-LOCC) just like the set of 
separable states is closed under local operations assisted by two-way classical com- 
munication (LOCC). Because of this, states with a symmetric extension often play 
the same role in a one-way communication setting as the separable states play in a 
two-way communication setting. 

We show that any state with a symmetric extension can be decomposed into a 
convex combination of states that have a pure symmetric extension. A necessary 
condition for a state to have a pure symmetric extension is that the spectra of the 
local and global density matrices are equal. This condition is also sufficient for two 
qubits, but not for any larger systems. 

We present a conjectured necessary and sufficient condition for two-qubit states 
with a symmetric extension. Proofs are provided for some classes of states: rank-two 
states, states on the symmetric subspace, Bell-diagonal states and states that are 
invariant under S 1 ' ® S, where S is a phase gate. We also show how the symmetric 
extension problem for multi-qubit Bell-diagonal states can be simplified and the 
simplified problem implemented as a semidefinite program. 

Quantum key distribution protocols such as the six-state protocol and the BB84 
protocol effectively gives Alice and Bob Bell-diagonal states that they measure in the 
standard basis to obtain a raw key which they may then process further to obtain 
a secret error-free key. When the raw key has a high error rate, the underlying 
Bell-diagonal state has a symmetric extension that must be broken with a two- 
way advantage distillation step before one-way processing can finish the job and 
generate a secret key. We analyze the currently used advantage distillation step and 
some generalizations of it and show that all these steps fail to break the symmetric 
extension for states at the current key distillation threshold. This shows that these 
generalizations cannot improve the currently best known threshold of the six-state 
protocol from 27.6 %. 
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Zusammenfassung 



Analog zur Spaltung der Menge von zweiteiligen Quantenzustanden in separable 
und verschrankte Zustande konnen wir diese Menge auch in Zustande mit und ohne 
eine symmetrische Erweiterung spalten. Die Zustande mit einer symmetrischen Er- 
weiterung — die alle separablen Zustande umfassen — verhalten sich in vieler Hin- 
sicht klassisch, wahrend die Zustande ohne eine symmetrische Erweiterung — die 
alle verschrankt sind — das Potenzial haben, Quanteneffekte zu zeigen. Die Menge 
von Zustanden mit symmetrischer Erweiterung ist unter lokalen Quantenoperatio- 
nen und klassischer Einwege-Kommunikation (1-LOCC) abgeschlossen, genau wie 
die Menge der separablen Zustande unter lokalen Quantenoperationen und klas- 
sischer Zweiwege-Kommunikation (LOCC) abgeschlossen ist. Aus diesem Grund 
spielen Zustande mit einer symmetrischen Erweiterung haufig die gleiche Rolle in 
einem Aufbau mit Einwege-Kommunikation wie separable Zustande in einem Auf- 
bau mit Zweiwege-Kommunikation. 

Wir zeigen, dass jeder Zustand mit einer symmetrischen Erweiterung in eine kon- 
vexe Kombination von Zustanden, die eine reine symmetrische Erweiterung haben, 
zerlegt werden kann. Eine notwendige Bedingung fur einen Zustand, eine reine 
symmetrische Erweiterung zu haben, ist, dass die Spektren der lokalen und glob- 
alen Dichtematrizen gleich sind. Fur zwei Qubits, aber nicht fur groBere Systeme, 
ist diese Bedingung auch hinreichend. 

Wir stellen eine vermutete notwendige und hinreichende Bedingung fur zwei- 
Qubit-Zustande mit einer symmetrischen Erweiterung auf. Beweise werden fur 
einige Klassen von Zustanden angefiihrt: Zustande von Rang zwei, Zustande auf 
dem symmetrischen Unterraum, Bell-diagonale Zustande und Zustande, die invari- 
ant unter S 1 ' S sind, wobei S ein Phasengatter ist. Wir zeigen auch, wie das 
Problem der symmetrischen Erweiterungen fur multi-Qubit Bell-diagonale Zustande 
vereinfacht und wie das vereinfachte Problem als semidefinites Programm imple- 
mentiert werden kann. 

Protokolle fur Quantenschliisselverteilung, wie das six-staie-Protokoll und das 
BB84-Protokoll, geben Alice und Bob effektiv Zugriff auf Bell-diagonale Zustande. 
Diese messen sie dann in der Standardbasis, um einen Rohschlussel zu erhalten, 
welchen sie weiterverarbeiten konnen, um einen geheimen, fehlerfreien Schliissel zu 
erhalten. Wenn der Rohschlussel eine hohe Fehlerrate aufweist, hat der zugrunde 
liegende Bell-diagonale Zustand eine symmetrische Erweiterung, die mit Zweiwege- 
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Zusammenfassung 



Vorteilsdestillation gebrochen werden muss, bevor durch weiterfiihrende Einwege- 
Kommunikation ein geheimer Schliissel generiert werden kann. 

Wir analysieren die derzeit verwendeten Vorteilsdestillations-Protokolle und ei- 
nige Verallgemeinerungen und zeigen, dass keins dieser Protokolle fur Zustiinde an 
den aktuellen Schliisseldestillationschwellen die symmetrische Erweiterung brechen 
kann. Dies zeigt, dass diese Verallgemeinerungen die derzeit hochste Schwelle des 
six-staie-Protokolls von 27.6% nicht verbessern konnen. 
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Most of the material included in this thesis can be found in two papers published 
in Phys. Rev. A and one upcoming paper. In the first paper [MRDL09], written 
together with Andrew Doherty, Joe Renes and Norbert Liitkenhaus, the symmetric 
extension problem is solved analytically for (two-qubit) Bell-diagonal states. These 
results can be found in this thesis in sections 3.3 and 3.4 where we have generalized 
the setting to multi-qubit Bell-diagonal states and sections 4.5.1 and 4.5.2. This 
paper also covers the results form Chapter 8 which says that at or above the thresh- 
old introduced by Chau [Cha02] , repetition code advantage distillation will produce 
states with a symmetric extension. In the second paper [ML09], together with Nor- 
bert Liitkenhaus, two-qubit states with a symmetric extension are analyzed. Section 

3.2 and chapters 4-6 come from this paper. The upcoming paper covers sections 

3.3 and 3.4 in its current form, chapters 7, 9, and 10, and appendix A. In addition, 
some of this work has been reported in conference proceedings [MLDR09] . 

The major part of the funding for my PhD has been through a personal PhD 
scholarship from the Research Council of Norway. This project was called "Quan- 
tum correlations for secret key distribution" and had project No. 166842/V30. Ad- 
ditional funding sources have been the European Union through the 1ST Integrated 
Project SECOQC and the IST-FET Integrated Project QAP, Ontario Centres of 
Excellence, the NSERC Innovation Platform Quantum Works the NSERC Discov- 
ery Grant. 

Throughout the work with my PhD I have interacted with many people and I 
am thankful for all conversations and support that I have received. There are many 
more than those I could possibly name here. 

First, I wish to thank my supervisor, Norbert Liitkenhaus for taking me on as 
a student and guiding me through the PhD. Also, many thanks to everyone at the 
Institute for Quantum Computing at the University of Waterloo and everyone else 
who made my years in Waterloo enjoyable. 

Some of the results in this thesis has come about with the help of others. The 
biggest part is probably from Andrew Doherty and Joe Renes who solved the sym- 
metric extension problem for Bell-diagonal states before I became a part of the 
collaboration, and it was through this that I learned the details of using semidefi- 
nite programming for solving symmetric extension problems. The proof of theorem 
11 was missing an essential piece until Marco Piani showed me how to fill in the 
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hole. For the numerical solution of semidefinite programs, Tobias Moroder's advice 
and initial Matlab scripts using Yalmip [L6f04] and the SDPT3 solver [TTT99] has 
been an invaluable starting point. Toby Cubitt's Matlab scripts [Cub] has saved 
me the trouble of having to implement some basic quantum information functions 
myself. The German version of the summary would have been full of mistakes if it 
had not been for Hauke Haseler's corrections. 

Throughout the work with my PhD I have enjoyed the hospitality of and dis- 
cussions with Johannes Skaar, Jon Magne Leinaas, Jan Myrheim, Michael M. Wolf 
and Matthias Christandl during visits. I have also enjoyed discussions with Barbara 
Kraus, Antonio Acm, and all the members of the Optical Quantum Communication 
Theory group at the IQC. 

Finally, a big thank you to my wife Kjersti for her love and patience and to my 
son Marius for always greeting me with a big smile when I come home. 
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Chapter 1 

Introduction 



In quantum key distribution (QKD), we use the physical principles of quantum me- 
chanics to distribute identical random bits to two (or sometimes more) cooperating 
parties while ensuring that no other party gains any knowledge about those random 
bits. The string of random bits that is produced is called a secret key. The creation 
of a secret key is a cryptographic primitive that can then be used to enable secret 
communication, message authentication, or other cryptographic tasks. 

A fundamental question in quantum key distribution is what the maximum rate 
of secret key is that can be generated, given an observed error rate 1 in a given 
QKD setup. A security proof will give a lower bound, since it typically will give an 
eavesdropper some extra power in order to simplify the problem and prove that a 
key can be generated at a certain rate. There are also various upper bounds on the 
key rate from entanglement theory and explicit attacks. 

An even more fundamental question is when a key can be generated at all 
and when it cannot. In protocols like BB84 [BB84] and the six-state protocol 
[Bru98, BPG99] the error can be summarized using one parameter, the quantum bit 
error rate (QBER). Using preprocessing followed by error correction to correct errors 
in the raw key and privacy amplification to remove any knowledge an eavesdropper 
may have about the key, the limit for provable secure key has been pushed to 
12.9% [SRS08] for the BB84 protocol. These techniques only need to use one- 
way communication from a sender to a receiver. At 14.6 % no secret key may be 
generated with one-way communication, since at this QBER an eavesdropper and 
the receiver may be in symmetric situation. This comes from a property of the 
underlying quantum state called a symmetric extension. 

It was discovered by Gottesman and Lo [GL03] that by using a two-way pro- 
Other observable parameters such as loss can also be taken into account. In this thesis we 
do not consider loss explicitly, but as long as there are no imperfections in the signal states or 
measurements we can consider only the signals that actually arrive in the BB84 and six-state 
protocol. With for example a multi-photon component in the signal states [BLMSOO] or a basis- 
dependent detector efficiency [MAS06, QFLM07], or for the B92 protocol [Ben92], it is crucial to 
take the loss into account. 
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Figure 1.1: Different QBER regimes for the BB84 and six-state protocols 



cedure derived from classical advantage distillation [Mau93] before error correction 
and privacy amplification, a key could be distilled even when it was provably im- 
possible with only one-way communication. Chau [Cha02] then showed that this 
technique could be used to distill a key for any QBER below 20.0 % in the BB84 
protocol. The upper bound when allowing two-way communication is 25.0 %, which 
is when the underlying quantum state may be separable. For QBERs between 20% 
and 25% it is not known whether a secret key can be produced at a finite rate or 
not. The work presented in this thesis is motivated by this gap. 

The ultimate goal would be to close the gap (see Fig. 1.1). This may be done 
either by proving that a secret key can be distilled all the way up to 25 %, or proving 
that no key can be distilled above 20 %, or establishing a new threshold which is 
both a lower and upper bound. 

For the six-state protocol, the picture is similar and the relevant QBERs for 
both protocols are illustrated in figure 1.1. The one-way lower bound of 14.6 % is 
taken from [KR08]. The one-way upper bound of 16.3 % is taken from [RGK05] 
and is slightly below the symmetric extension bound of 16.7 %. 

There have been previous attempts at shrinking the gap. Acin et al. showed 
in [ABB+06] that the 20 % limit that Chau had found was indeed as high as 
possible with the prescribed key distillation procedure, since there is an explicit 
attack that puts an eavesdropper in a similar situation as the receiver after the 
two-way advantage distillation part of the procedure. Portmann tried to change 
the advantage distillation to detect errors using random parities on larger blocks, 
but could only prove a BB84 secret key rate up to 16.9 % using that technique 
[Por05]. Finally, Bae and Acin attempted to improve the threshold by adding noise 
in the beginning of the procedure, allowing coherent quantum operation on one side 
or measuring in a different basis, but without success [BA07]. 

In this thesis we seek to learn from how a key can be distilled by two-way 
processing when it is impossible to distill by one-way processing. In this regime, 
the underlying quantum state starts out with a symmetric extension, but through 
a sequence of two-way steps the symmetric extension is broken and the rest of the 
protocol can proceed using the same one-way techniques that on its own could not 
possibly distill key above 14.6 %. This has led us to investigate which states have 
a symmetric extension, a question which may also be interesting for other areas of 
quantum information. Furthermore, we have looked at different types of advantage 
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distillation and find evidence that they fail to break a symmetric extension and can 
therefore not be used to shrink the gap from below. 

Some of the results apply both to the BB84 protocol and the six-state protocol, 
but some only apply to the six-state protocol. The six-state protocol is easier 
to analyze since the measurements give full tomographic information about the 
quantum states. In particular, the analytical computation in chapter 9 and the 
numerical computations in chapter 10 are done for the six-state protocol only. 

The rest of the thesis is organized as follows. Chapter 2 contains preliminaries 
on quantum mechanics, quantum key distribution, and semidefinite programming. 
Part I, consisting of chapters 3-6, contains results related to states with a symmetric 
extension. Part II , consisting of chapters 7-10, analyzes QKD with different kinds 
of advantage distillation and find that all the resulting states have a symmetric 
extension. 
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Chapter 2 

Preliminaries 



2.1 Quantum mechanics 

The quantum mechanics of a closed (isolated) system is described mathematically 
by assigning to it a separable complex Hilbert space %. We will only deal with 
systems with a finite Hilbert space dimension and in this context any complex 
Hilbert space reduces to a complex vector space with an inner product. We denote 
vectors in the Hilbert space using the bra-ket notation. A vector with the label ip is 
denoted \ip) and its dual vector in the dual Hilbert space is denoted The inner 
product between two vectors and ^2) is written (V'llV^)- 

2.1.1 Quantum states 

The physical state of a quantum system where we have complete information is 
described by a ray (i.e. a one-dimensional subspace) in the Hilbert space. Such a 
state is called a pure state. Usually, we choose a unit vector in a ray to represent 
the state. With this representation, if the unit vector \tp) represents a state, also 
the vector e 1 ^^), represents the same state. To avoid this ambiguity, we may use 
the one-dimensional projector \ifj){ip\ to represent the state. Then, unlike the unit 
vector representation, different projectors correspond to different states. 

In many cases we do not have complete information, either because we have a 
statistical mixture of pure states or because the system is part of a bigger system 
which is in a pure state. An ensemble of pure states {(pi, is a set of pure states 

{|V>i)} where each has an associated probability pi. To any ensemble, we have a 
corresponding mixed state, a quantum state with incomplete knowledge. The mixed 
state corresponding to the ensemble {(pi, is 



There is a continuum of different ensembles that realizes any given mixed state, but 




(2.1) 
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there is no physical way to distinguish them, so they all correspond to the same 
mixed state. 

The operator p is called a density operator or a density matrix. In general, 
we define a density operator or density matrix as a positive semidefinite operator 
with trace 1. Any density operator represent a pure or mixed quantum state. The 
density operator representing the pure state \tp) is simply p = Since any 

positive semidefinite operator is also a Hermitian, it can be decomposed using the 
spectral decomposition 

p = J2M<f>i)(U (2-2) 

i 

The eigenvalues and eigenvectors form an ensemble {\i,4>i}, but the only property 
that makes this somewhat special compared to other ensembles realizing the same 
density matrix is that it consists of orthogonal states. 

In addition to distinguishing between pure and mixed states, we can also quan- 
tify their purity. There are several functions including entropies that can do this, 
and they are usually a function of the eigenvalues only. One quantity that will be 
useful later is the purity, defined as tr[p 2 ]. A purity of one means that the state is 
pure and otherwise it is mixed. 

The density operator is our preferred representation of a quantum state, but 
since the unit vector representation of pure states makes calculations both easier 
and clearer we will often use that for pure states. 



2.1.2 Unitary evolution 

A quantum system starting out in a prepared state will change over time. For a 
pure state in a closed system the exact time evolution is given by a Hamiltonian 
operator H through the Schodinger equation, 

««=W). (2.3) 

For a mixed state, the evolution can be computed by decomposing it into an ensem- 
ble of pure states. Alternatively, it can be described by the von Neumann equation, 

ih^ = Hp- P H. (2.4) 

Since these equations essentially give the time derivative of the state (|^) or p) as 
a system-dependent function of itself, this gives the evolution of any starting state 
for any later time. 

For our purposes, we will only be interested in the initial state and the state at 
some later time. The evolution is then best described by a unitary operator, 



m = u\ip ), 



(2.5) 
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and 

P = Uporf, (2.6) 

where 

U = exp(-iHt/h) (2.7) 



when H is time independent. For a given time interval it is possible to achieve any 
unitary operator U by choosing an appropriate Hamiltonian H. 

2.1.3 Measurements 

In classical systems we can have measurements that do not change the classical 
state of the system. In practice some systems may be more delicate than others, 
but there is no fundamental principle that excludes such perfect measurements. A 
mathematical description of a classical measurement therefore only need to specify 
what result it would get for any possible state of the system. Except in the trivial 
case where the measurement result is independent of the system state, a quantum 
measurement cannot avoid disturbing the system to some degree. For a full de- 
scription of a quantum measurement we therefore need to specify the measurement 
results for all possible states, but also how the state changes after a measurement. 
While we can also allow a classical measurement to give probabilistic outcomes 
for a given system state, even an ideal quantum measurement gives probabilistic 
outcomes on many states and we can therefore only describe their probability. 

We first describe ideal measurements, i.e. measurements that contain no other 
imperfections than those imposed by quantum mechanics. Such measurements are 
sometimes called generalized measurements [NCOO] to distinguish them from the 
special case of projective measurements. A p-outcome measurement is described by 
a set of p Kraus operators [Kra71, Kra83] (called measurement operators in [NCOO]), 
{K m } p m=1 that satisfy 

v 

KlK m = 1. (2.8) 

m=l 

When a density operator p is measured, the probability for outcome m is 

p m = tT[K m pKl] (2.9) 

and condition (2.8) is simply that the probabilities sum up to 1. The state after 
the measurement is then 

Pm = —K m pKl. (2.10) 

Pm 

Because of the form of this, we will sometimes compute the unnormalized state 
after measurement 

p m = K mP Kj n (2.11) 

and remember that the trace of the unnormalized state is the probability of this 
outcome. 



8 



Chapter 2. Preliminaries 



If we add a result-dependent unitary operator to the left of each Kraus operator, 
that does not change the probability for any of the outcomes, but it changes the 
resulting state. That is, the set {U m K m } gives the same measurement statistics as 
the set {K m }. 

Measurements may include random choices made by the measurement device. 
Say that a measurement device makes a random choice between q different mea- 
surements. Measurement k is described by the Kraus operators {kS'}^ =1 and is 
chosen with probability g&. The measurement including the random choice can be 
described as a measurement with pq outcomes described by the measurement oper- 
ators {^/q^Km^}- This kind of measurement is used in the BB84 and six-state QKD 
protocols, where there is a random choice between different measurement bases. A 
trivial example of this kind of a measurement is one that does nothing to the state 
and gives a random outcome k with probability qt- This measurement is described 
by the Kraus operators {y^l}. 

The measurements described by Kraus operators are ideal in the sense that the 
state after the measurement is not disturbed more than necessary. If a pure state is 
measured, the post-measurement state is also pure. A real imperfect measurement 
device may of course add some noise and turn a pure state into a mixed state. 

A special class of measurements are projective measurements. Each Kraus oper- 
ator is then an orthogonal projector — = K rn and Km = K m — and in addition 
they project onto orthogonal subspaces, K m K n = 5 mn K m . A projective measure- 
ment is usually represented by an Hermitian observable operator, 



The distinct eigenvalues X m label the outcomes and the state gets projected onto 
the eigenspace by the projector K m . We say that we measure the operator O 
and get outcome \ m . One example that we will use later is the Pauli operator 
o~ z '■= |0)(0| — |1)(1|, which can give outcomes Ai = +1 or A2 = —1 and will project 
the state to |0) or |1), respectively. We can also be interested in the expectation 
value of an operator O on a given state p, i.e. the average value of the eigenvalue 
X m when measured many times. This has the straightforward expression, 



In many cases we are only interested in the measurement outcomes and not in 
the state after after the measurement. In that case it is more convenient to use a 
positive operator-valued measure (POVM) to describe the measurement. Any set of 
positive semidefinite operators {F m } such that 




(2.12) 



m 



(0) p :=tv[Op}. 



(2.13) 



(2.14) 
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is a POVM, and its individual operators are called POVM elements. The probability 
of obtaining outcome m is 

Pm = tr[F mP }. (2.15) 

With a given set of Kraus operators {K m }, a POVM is constructed by taking the 
operators F m = KmK m . With a given POVM {F m }, one set of Kraus operator 
that gives the same measurement statistics is {K m = \/F rn } 

One advantage of using POVMs instead of Kraus operators is that it is easy 
to coarse grain results. Say that a physical measurement can be described by a 
p-element POVM {F m }^ =1 . The p outcomes can be divided into q < p subsets 
{5„}* =1 and we are only interested in knowing in which subset the result was. We 
can think about this as a ^-outcome measurement. The q POVM elements for this 
measurement are 

Gn = Fm - ( 2 - 16 ) 

m£5 n 

2.1.4 Composite systems 

So far we have looked at a quantum system as a whole. In many cases they consist 
of distinct subsystems and in the context of quantum information theory, these 
subsystems may even be in remote locations. When we have n subsystems, each 
with its Hilbert space Hi, the Hilbert space of the joint system is the tensor product 
of the individual Hilbert spaces, 

fttotai = Wi ® w a ® ■ ■ ■ ® w«. (2.i7) 

If each of the n subsystems is in a pure state \ipi), the state vector of the joint 
system is 

|^} = |^}®hfe}®---®M>n>, ( 2 - 18 ) 
which we will sometimes write without the tensor product symbol as \ipi)\ip2) • • • \ ip n ) 
or even just as one single ket \1p1ip2 ■ ■ ■ i/) n ) ■ Note that most vectors in % total are n °t 
of the product form (2.18) but rather linear combinations of those. 

We will now restrict the discussion to two subsystems A and B with Hilbert 
space Hab = Ha®Hb- Most properties can be generalized to more subsystems by 
considering A and B as being subdivided into smaller subsystems. 

We can ignore one part of a composite quantum system by taking the partial 
trace over it (we also say that we trace out the system). Let us say that we have 
a density operator p AB on Hab and we want a description of the state of the B 
system. We then take the partial trace over system A to obtain the reduced density 
operator, reduced state, or simply reduction to B. We write this as 

p B = ti A [p AB }. (2.19) 
The partial trace is defined on product operators by, 



ti a[M (g> N] = tr [M]N 



(2.20) 
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and is a linear operator. By decomposing a general density operator p 
orthogonal bases {|eij)} and 



AB 



p AB = ^ Pijkl \a i b j ){a k bi\ = ^2pij,ki\ai)(a k \ ® \bj)(b, 

ijkl ijkl 



using 
(2.21) 



the definition yields 



ti A [p AB ] = J2pijM tT A[\ai)(a k \ ® \bj){bi\] 



ijkl 



J2pij,ki tr[|oi)(a fc |]|6j)(6j 

ijkl 

J2pij,ii\ b i)( b i 



J i ■ 



ijkl 



Note that unless a pure state is a product state = \tpi) <8> |Y>2)j its reduced states 
are mixed states. 

A product state is a state of the form 



Pproduct =/»p B 



(2.22) 



In this case, the states of the A and B systems are independent. The class of states 
that are convex combinations of product states, 



rscp 



= ^Pipf®pf, 



(2.23) 



are called separable states. Here, the states of the two subsystems are not indepen- 
dent, but all correlations between the two systems are classical. There are many 
states that are not separable, and they are called entangled. Entangled states can 
be used to perform tasks that are impossible to recreate classically, and quantum 
key distribution is one of them. 

2.1.5 Qubits and Pauli operators 

Many of the quantum systems that we use in this thesis are built up from qubits. 
A qubit is the simplest nontrivial quantum system in that the Hilbert space is 
two-dimensional. The two orthogonal unit vectors |0) and |1) are called the com- 
putational basis of the Hilbert space. 

When dealing with qubits, it is convenient to use the Pauli operators, 

"0 1" 

1 ' 



cr. 



|0)(l| + |l)(0h 
r y :=-i|0)(l| + i|l)(0| 

j z := |0)(0|-|l)(lh 



-i 

1 

1 0' 

1 



(2.24a) 
(2.24b) 
(2.24c) 
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They all have eigenvalues +1 and —1. Their spectral decomposition is 

°x ■= l+X+l-RH. (2-25a) 
a y := | +i)(+i| - I - i> < — i | , (2.25b) 
<t,:=|0)(0|-|1)<1|, (2.25c) 

where |±) := ^=(|0) ± |1)) and | ± i) := ^(|0> ± i|l)). 

The three Pauli operators are often indexed as o\ := a x , a 2 ■= cr y , 03 := a z The 



set of Pauli operators are often extended to include the identity operator 1, and it 
is then sometimes written as o~q. Together, these four operators form a Hermitian 
operator basis for the qubit space. 

Computations including Pauli operators are often simplified using their com- 
mutation and anticommutation relations and the fact that they are square to the 
identity operator, o~f = 1. Of course, all operators commute with itself and o"o = 1, 
<7jl = l(Tj. Otherwise, they all anticommute, o~iO~j = —OjGi for i 7^ j € 1,2,3. 
For example, cr x a y a x = —cr x a x a y = —cr y , where we first used the anticommutation 
relation between a x and a y and then that a x a x = 1. 

The final useful property is that products of Pauli operators are proportional to 
Pauli operators, 

a x a y = ia z , (2.26a) 
o y o z = ia x , (2.26b) 
c^Cx = icy (2.26c) 

Any density operator on a single qubit can be written as 

^(1 + r x a x + r y Oy + r z a z ), (2.27) 

with three real parameters rj. An operator of this form is positive semidefinite 
whenever + r y + r 2 z < 1 . This means that the possible density operators form a 
sphere in the parameters space, and this sphere is called the Block sphere. The 3- 
component vector (r x ,r y , r z ) is called the Block vector of the state. The components 
of the Bloch vector can be found from rj = trfoj/?]. 

Similar to the Bloch vector for one qubit is the 4x4 i?-matrix for two qubits. 
Its components are 

r ij =tr[(a i ®a j )p], i, j € {0, 1,2,3}. (2.28) 

Any two-qubit state can be written in terms of these parameters, 

^33 

i=0 j=0 
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A special case is when the i?-matrix is diagonal, i.e. the state is of the form 

1 3 

p= - ^ruai^ai. (2.30) 

i=0 

This is called a Bell-diagonal state, since its spectral decomposition is of the form 
p = Pl \$+)($+\ + p x \y+)(y+\ + p y \y-)(y-\ + p z \$-)(<I>-\, (2.31) 

where 1^) = ^(|00) ± |11)) and |*±) = ^(|01) ± |10>) are the maximally entan- 
gled Bell states. The eigenvalues of a Bell-diagonal state are related to the diagonal 
elements of the i?-matrix as 



PI = 


1 

-(1 + rn - r 22 + r 33 ), 


(2.32a) 


Px = 


|(1 + rn + r 22 - r 33 ), 


(2.32b) 


Py = 


1 

-(1 - rn - r 22 - r 33 ), 


(2.32c) 


Pz = 


|(1 - rn + r 22 + r 33 ). 


(2.32d) 



For iV qubits, we can write any state as 

^3 3 

P = ^N^2'" Yl "h-iN^ii ® ■ ■ ■ ® o-iiv- (2-33) 

U=0 «AT=0 

The parameters a^...^ are then 

a il ... iN = ti^a^ <g) ■ ■ ■ (g) C7 ijv )p]. (2.34) 

The Pauli operators are also unitary, so they also describe evolution of qubit 
states. Each Pauli operator corresponds to a rotation of an angle tt, a x around the 
r x axis, a y around the r y axis, and a z around the r z axis. Since a x interchanges |0) 
and |1) it is called a bit-flip operator. Similarly a z is called a phase-flip operator 
since it interchanges a\0) + /3|1) with a|0) — /3|1). Since a global phase of a state 
vector is irrelevant, the Pauli operator a y = \a x a z is both phase and bit flip. 

Finally, the Pauli operators are used to describe measurements on qubits. Since 
they are Hermitian operators they are observables and describe a projective two- 
outcome measurement, each outcome corresponding to one of their eigenvalue. For 
example, a measurement of a x can get the two outcomes +1 or —1 and the state 
after measurement is then |+)(+| in the first case and |— )(— | in the second. The 
expectation value (<jj) = tr [cr^p] = rj is the a component of the Bloch vector. Tensor 
products of Pauli operators only have the two eigenvalues +1 and —1 and therefore 
describe measurements with only two outcomes. 
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2.2 Quantum key distribution (QKD) 

In quantum key distribution the quantum mechanical nature of fundamental infor- 
mation carriers is exploited to generate a secret key shared by a number of coop- 
erating parties. In this thesis we will only consider two cooperating parties and by 
convention they are called Alice and Bob. By the same convention, any eavesdrop- 
per is called Eve. In general, Eve is assumed to control anything and anyone who 
is not under Alice and Bob's control. Alice and Bob can communicate classically 
on a public, but authenticated channel. That is, Eve can listen to all classical com- 
munication between Alice and Bob, but cannot change it. The authentication can 
be implemented by a small pre-shared secret key, so we do not really need to make 
any unrealistic assumption about the physical channel. In addition to the classical 
channel, Alice and Bob has some way of exchanging quantum states. This quan- 
tum channel has no built-in authentication and Eve is allowed to do anything on 
it that quantum mechanics allows. We assume no computational or technological 
limitations on Eve. In practice the quantum channels are usually optical fibers or 
free space and the quantum signals that are sent through them are pulses of weak 
light. 

In this situation, Alice and Bob can use the quantum channel to distribute 
quantum signals which are the measured. When this is done right, they can use 
some of their measurement results and the laws of quantum mechanics to estimate 
Eve's knowledge about the other measurement results. If they find that Eve has 
sufficiently little information about their results, they can coordinate their effort 
using the classical channel and produce a secret key from the measurement data. 

2.2.1 Prepare and measure QKD 

The first QKD protocol to be described [BB84] was a prepare and measure (P&M) 
protocol. In such a protocol, Alice prepares an ensemble of n quantum states 
{(Pi> IV'i))}^].) where at least some of the are nonorthogonal. She chooses a 
state \ipi) according to the probability distribution pi and sends it to Bob over the 
insecure quantum channel. Bob measures the incoming state using a POVM with 
m POVM elements 1 , {Fj} 1 J! =1 . This is repeated many times. 

After Alice has sent the signals and Bob has acknowledged receiving and mea- 
suring them, they choose a random subset of the signals where Alice announces 
which signal she sent and Bob announces which measurement result he got. With 
this information, Alice and Bob can estimate the conditional probability distribu- 
tions pju — the probabilities that Bob gets measurement outcome j when Alice sends 

1 In many protocols, Bob chooses randomly between a set of measurements. In this context, 
where we assume that we know the details about how our devices are working, we include that 
random choice as part of the measurement device (see section 2.1.3). In other contexts, such as 
post-quantum [BHK05] and device-independent [ABG + 07] QKD, it is important that this choice 
is made outside the apparatus and we would have to describe a measurement for each choice. 
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state i — and the joint probability distribution pij. This phase is called parameter 
estimation. In this thesis we assume that Alice and Bob have enough data available 
that they can estimate arbitrarily well. In practice, the finite size of the datasets 
may make the parameter estimation more involved [SR08, CS09]. 

This joint probability distribution tells them whether the data is well enough 
correlated and with sufficiently low information leakage to Eve. If it is, they can 
proceed with postprocessing in order to generate a secret key. If this is not the 
case, they will abort the protocol. If the data passes the test, the joint probability 
distribution p^ is used to decide various parameters in the postprocessing which 
will ultimately decide the length of the secret key. Alice and Bob exchange messages 
about their data and use this information to distill a secret key. The details of this 
postprocessing will depend on the protocol 

2.2.2 Entanglement based QKD 

A seemingly different approach to quantum key distribution is based on bipartite 
entangled states [Eke91]. An untrusted source produces bipartite entangled states 
and sends one subsystem to Alice and the other to Bob. Alice measures her part 
of the quantum state with a POVM {vlj}™ =1 and Bob measures his with a POVM 

{Bj}?=v 

The parameter estimation is similar to the prepare and measure case. After 
both parties have measured the quantum systems and acknowledged that to the 
other party, they randomly choose a subset where they announce their measurement 
results. Using this data, they can estimate the joint probability distribution qtj, the 
probability that Alice gets outcome i and Bob gets outcome j. They can use the 
joint probability distribution qij to estimate the joint quantum state that they 
received from the untrusted source over the untrusted channel. The quantum state 
can be any p AB that satisfies 

qij = tr[(A- ® Bj)p AB ] (2.35) 

In some protocols, Alice and Bob's measurements are tomographically complete, so 
the joint quantum state is fully determined by the joint probability distribution. 
In other protocols they can only estimate some parameters of the quantum states 
while others are left open, giving an equivalence class of possible quantum states. 

If all the quantum states compatible with the measurement data are sufficiently 
entangled (i.e is well correlated with low information leakage), Alice and Bob pro- 
ceed with postprocessing to generate a secret key. 

2.2.3 Equivalence between prepare and measure and entanglement 
based 

In a prepare and measure scheme, there is never any entanglement or even bipartite 
systems involved. In the entanglement based scheme, there is full symmetry between 
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Alice and Bob who both passively receive quantum signals from a third-party source. 
Nevertheless, a prepare and measure scheme is equivalent to an entanglement based 
scheme where the source is placed next to Alice's measurement device. The two 
setups are indistinguishable from Eve's point of view [BBM92] . 

When the entanglement source is placed next to the measurement device, they 
form a state preparation device. Let the source produce some pure bipartite entan- 
gled state \ip)AA' = J2rs a rs\r) <S> \s). Alice can measure using a POVM where each 
POVM element is proportional to a one-dimensional projector 2 , Ai = ki\4>i) (4>i\ . 
She then gets outcome i with probability p, = ki tr[(|0i)(^|.A <g) 1a')|V')(V'Ua'] and 
effectively prepares the state \ipi)A> = ({4>i\A ® IaOIV 7 ) AA' = Srs(^l r ') Q; "l s )^' m 
system A' which is subsequently sent to Bob over the channel. The time ordering 
of Alice measuring system A and sending system A' to Bob is not important. If 
Bob has received the system (and even if he measured it), Alice's measurement 
effectively prepares Bob's signal state at a distance. 

When the signal ensemble {(pi, \tpi))}f=i in a prepare and measure scheme is 
given, a preparation device can be based on a source of the entangled state 

n 

W)AA> = ^2 VPj\ m j)A ® \lpj)A', ( 2 - 36 ) 
i=i 

where {|mj)}" =1 are orthonormal. Alice's measurement will then be simply a pro- 
jective measurement, Ai = \mi){mi\. Note that while the n nonorthogonal states 
often span a Hilbert space %a' of dimension less than n, the system A is here 
n-dimensional. It is possible to write \i/))aA' hi the Schmidt decomposition, 

dim(A') 

W)AA' = ^2 =s iK)®K)' ( 2 - 37 ) 
i=l 

thus identifying a subspace of A of the same dimension as A' . If we also project 
the original POVM elements onto this subspace, we can get an entanglement 
based scheme where both systems are of dimension dim(^4'). 

The main advantage of the equivalence between entanglement based and prepare 
and measure QKD is that it allows us to analyze a prepare and measure scheme by 
analyzing the equivalent entanglement based scheme. We will therefore use the data 
from prepare and measure schemes to reconstruct an effective bipartite state p AB , 
which will be the state that had arrived at Alice and Bob's measurement devices if 
the state preparation had been based on a source of entangled states. We will see 
in sections 2.2.7 and 2.2.8 that we can use this state in the security analysis of the 
protocol. 

2 She could also measure using any POVM, with the only consequence that in general, POVM 
elements that are not proportional to a one-dimensional projector will be equivalent to Alice prepar- 
ing a mixed signal state. 
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2.2.4 Attacks on QKD protocols 

As mentioned earlier, Eve is allowed to do anything allowed by quantum mechanics 
in her eavesdropping of the quantum channel. We can divide Eve's attacks into 
three classes, depending how much of that power Eve actually uses. 

Individual attack. Eve attaches a probe to each of the quantum signals and lets 
the probe interact with the signal in the way she chooses. Then she measures 
each probe with any POVM 3 . 

Collective attack. Eve attaches a probe to each of the quantum signals and lets 
the probe interact with the signal in the way she chooses. She may then do a 
collective measurement on all the probes together (which may give here some 
advantage over measuring each individually). She may also postpone this 
measurement indefinitely, e.g. until the key is being used (which may reveal 
some the bits). 

Coherent attack. Eve uses one big probe to interact coherently with all the quan- 
tum signals at the same time. Sometimes also called joint attack. 

Individual attacks are rarely analyzed anymore. The main motivation for analyzing 
them was that there were no known ways of quantifying quantum information about 
classical data and people wanted to show that Eve's information about the key was 
small. 

In a collective attack, Eve is allowed to keep quantum information about the 
measurement results. The simplifying assumption here is that since Eve uses indi- 
vidual probes, the signal pairs that Alice and Bob receive will be independent and 
identically distributed (i.i.d.). That is, after receiving n signals each, they have a 
state of the i.i.d. form (p AB )® n . Alice and Bob estimate p AB by estimating the 
joint probability distribution qij from their data and using Eq. (2.35). 

In a coherent attack, the signals that Alice and Bob receive may be correlated 
in an arbitrary way. They simply receive one big state distributed on 2n quantum 
systems. For some protocols their structure makes it possible to reduce a coherent 
attack to a collective attack [KGR05]. For other protocols using finite-dimensional 
signal states, the exponential de Finetti theorem (or global representation theorem) 
[Ren07] can be applied. It states that as long as there is a permutation symmetry 
between the signals, the state that Alice and Bob receive can be regarded as being 
i.d.d. on all but a small subset of the signals. This means that for many protocols, 
it is sufficient to show security against a collective attack. 

In this thesis we do not attempt to show security for any QKD protocols. Rather 
we show in chapters 8, 9, and 10 that a collective attack is sufficient to break the 
security for some types of postprocessing when the estimated state is too noisy. 



3 In protocols that include sifting, Eve may be allowed to wait for the sifting information before 
measuring. 
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We will therefore always assume that Alice and Bob's data come from comes from 
measurements on i.i.d. states, and the only justification we need for that is that 
this is a possible strategy for Eve. 

Eve can choose any state p AB and then distribute many copies to Alice and 
Bob. While Alice and Bob will be able to estimate this state (or at least some of 
its parameters), they have to assume that Eve can be correlated with this state in 
an arbitrary way. The worst case is that Eve has the full purification of the state 
(since nothing is correlated with the random results of a measurement on a pure 
state). Alice and Bob therefore always assume that their state is part of a pure 
state, p AB = tiE \^){^\ei where Eve is in possession of system E. 

In an entanglement based scheme it is evident that Eve may indeed choose to 
give Alice and Bob any state p AB of her choosing, since she is assumed to have full 
control over its distribution. In a prepare and measure scheme or — equivalently — an 
entanglement based scheme where the source is in Alice's lab, Eve only has access 
to one of the two particles from the source. Alice's part p A of the final state p AB 
must therefore be the same as her part of the source's state \ip)(ip\AA', 



This additional restriction is useful for Alice and Bob in cases where their mea- 
surements do not allow them to estimate all parameters of p A . Apart from this 
restriction, Eve can transform the state to any state of her choosing by operating 
only on the system in transit from Alice to Bob [CLL04]. 

2.2.5 The six-state QKD protocol 

Two of the most celebrated QKD protocols are the BB84 protocol [BB84] and the 
six-state protocol [Bru98, BPG99]. They are both originally qubit-based prepare 
and measure protocols, but as we saw in section 2.2.3 they can also be converted 
to entanglement based protocols. The BB84 protocol is the one which is most well 
known and most used in experiment. The six-state protocol adds two signal states 
which makes theoretical analysis easier, since all parameters of the state in the 
entanglement based scheme can be estimated and it has a higher noise threshold. 
The six-state protocol uses the following six states as signal states, 




(2.38) 




(2.39a) 

(2.39b) 

(2.39c) 

(2.39d) 

(2.39e) 
(2.39f) 



10), 
|1>. 
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The two first states are eigenvector of a x and are therefore called the x basis. 
The next two are eigenvectors of a y and are called the y basis. The last two are 
eigenvectors of a z and are called the z basis or computational basis. Each basis is 
chosen with equal probability and each state within a basis is chosen with equal 
probability, giving probability 1/6 for each signal state. 

The six-state measurement on Bob's side is described by a POVM with the 
elements 



F+ = l\+)(+\, (2.40a) 

F- = ll-X-l, (2.40b) 

F +i = ||+i)(+i|, (2.40c) 

F_i = ||-i)(-i| (2.40d) 

F o = i|0)(0|, (2.40e) 

F 1 = i|l)(l|. (2.40f) 



This can be implemented as a random basis choice followed by a projective mea- 
surement in that basis. 

The three bases that are used in the six-state protocol are mutually unbiased, 
which means that if a state from one basis is measured in one of the other bases, 
the outcome is uniformly random and therefore contains no information about the 
original state. Alice therefore announces to which basis each of her signals belong, 
and Bob similarly announces which basis was used to measure each signal. They 
then discard their data for each signal where they used a different basis, since Bob's 
measurement result then is unlikely to be correlated with Alice's choice of signal. 
This step is called sifting. 

On average the sifting step will throw away 2/3 of the signals. It is possible to 
throw away only a negligible fraction by choosing the z basis with probability 1 — e 
and the two others with probability e/2 for a small e [LCA05]. Since we are only 
interested in whether a key can be distilled or not, we keep the probabilities equal. 

The prepare and measure six-state scheme can be converted to an entanglement 
based scheme using the recipe in the previous section. The entangled state is 



AA! = 



l\\mo)A\+)A> + \[\\m\) a\~) A' + ^\\m2) 



a\ + t)a' 
'i 



+ yg|m 3 )A| - l)A' + \[\\ m i) A\ty A> + \J\\ m b) A|l) A' , (2.41) 



and measuring it in the computational basis at A effectively prepares the signal 
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states with the correct probabilities. The state in Eq. (2.41) can be written as 



)AA> 



+ 



Y2\m )A + \J\\W\)a + \f^\m 2 )A + \J~^\m 3 ) A + y^|m 4 )A^ \0)a' 
(\fh\ m o)A - Y^l m i)^ + iyf^\m2)A ~ iy^l^A + \Jl\ m 5)A^J |1) 



.4' 

(2.42) 



which is a Schmidt decomposition since the two vectors, 



i 

v/2 
1 

72 



\uo) 



\\m )A + A/ nl m l)^ + V T2~l m 2) 



A + V h\m^) A + yhm^A, (2.43a) 



+ \\l jz\m 2 )A ~ W \\\rri3)A + V §l m s)A 



(2.43b) 



are orthogonal. This means that we can look at the initial state as a two-qubit 
maximally entangled state \^)aA' = ^(l u o)|0) + |ui)|l)). We let |uo) and \u\) be 
the computational basis for the qubit space in the A system and rename to the 
standard convention so that the form of the state is 



I A A' 



V2 



(|00> + |11». 



(2.44) 



To get the POVM elements on this 2-dimensional A system, we project the vectors 
\rrii) down to the subspace spanned by \uo)a and lui}^ and rename correspondingly. 
Using the projector ir = |0)(uo| + |l)(iti|, we get 



ir\mo) 
7r|mi) 
vr|m 2 ) 
7r|m 3 ) 

7r|?7l4) 

vr|m 5 ) 



|0>- 
|0>- 

|0>- 

|o>- 

10) , 

11) . 



1) 



+ 



+ i 



(2.45a) 
(2.45b) 
(2.45c) 
(2.45d) 
(2.45e) 
(2.45f) 



The POVM elements are then {-7r\mi) (mi\-K^ This is the same measurement as 
Bob's, as given in Eqs.(2.40a)-(2.40f). Note that from Eq. (2.41) we can see that 
Alice's POVM element it\m2) {m2\~K^ = || — i| on the A system projects the A' 
system to the state | +i)(+i|. In general, measurements in the y basis on A projects 
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the state to the orthogonal state on A' , while in the x- and z bases, the states are 
projected to the same state in the two systems. 

The sifting is done such that it is indistinguishable from the prepare and measure 
sifting. Instead of announcing in which basis her signal state was sent in, Alice 
really announces in which basis the measurement result was, since the measurement 
effectively prepares a signal state in the same basis. 

2.2.6 The BB84 protocol 

The BB84 protocol is similar to the six-state protocol with the exceptions that the 
signal states | + i) and | — i) are not used, i.e the BB84 signal states are 



|+>:=^(|0> + |1», (2.46a) 

|-):=^(|0)-|1)), (2.46b) 

|0), (2.46c) 

|1). (2.46d) 



Like for the six-state protocol, the signal states are chosen with equal probability. 
Similarly, only measurements in the x- and z basis are used. This means that 
instead of the six POVM elements in Eqs. (2.40a)- (2.40f) the POVM elements for 
the BB84 measurement are 

F o = i|0)(0|, (2.47a) 

Ft = ^\l)(l\, (2.47b) 

F+ = ~\+)(+\, (2.47c) 

F- = \\-}(-\. (2.47d) 

In the entanglement based BB84, both Alice and Bob use this measurement. 

The sifting in the BB84 protocol is analogue to the six-state sifting. Alice and 
Bob keep their data if the signal and measurement (or the two measurements in the 
entanglement based picture) are in the same basis. The BB84 sifting only discards 
1/2 of the signals due to wrong basis instead of 2/3 for the six-state sifting. Like 
for the six-state protocol, one basis can be chosen more often in order make this 
loss negligible, but we do not consider this here. 

2.2.7 Parameter estimation in the six-state and BB84 protocols 
Full parameter estimation 



For the purpose of analyzing the protocols, we consider the entanglement based 
schemes, even if the actual implementation may be prepare and measure. Let us 
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first assume that the parameter estimation is done before the sifting step throws 
away the data where Alice and Bob used different basis. We will relax this later so 
that they can do a meaningful parameter estimation also after sifting. 

For the six-state protocol, both Alice and Bob receive a qubit which they mea- 
sure using the POVM from Eqs. (2.40a)-(2.40f). From those measurement results 
that they announce publicly, they reconstruct the joint probability distribution qij. 
This probability distribution is somewhat redundant in that the coarse grained 
measurement results 

F + F 1 = h (2.48a) 

F + + F. = \l (2.48b) 

F +i + F_ i = h (2.48c) 

are proportional to 1 and therefore their probability is independent of the measured 
state (it is simply the probability to choose a basis). For this and other reasons 
it can be useful to first use the probabilities to compute the Z2-matrix of the state 
(see section 2.1.5), where each matrix element is given by the expectation value 
Tij := tr[(<7j % <fj)p ] where oo := 1 and 01,02,03 are a x ,a y ,cr z , respectively. For 
this, they can use 

ox = l+X+l - l-X-l = 3(F + - F_), (2.49a) 
a y = \+ i)(+i| - I - i)(-i| = 3(F +i - F_0, (2.49b) 
a z = |0> <0| - |1)(1| = 3{F - Fx). (2.49c) 

For example, the r\z expectation value is 

ris := te[{o x a z )p AB ] 

_ tr{{{F + -F_)®{F G -F 1 )}p AB } 
tr[{{F + + F_) ® (F + Fi)}pAB] 

^ q+,o - q+,i - q-,o + q-,i 
q+,o + g+,i + q-jo + q-,i 

The state can be reconstructed from the i?-matrix as 

3 3 



(2.50) 



P AB 



i=0 j=0 



Since the full i?-matrix is known from the measurements in the six-state protocol, 
the state is fully determined. 

The state can also for the BB84 protocol be reconstructed via the ZZ-matrix. In 
this case, however, the coefficients T2i and rj2 in Eq. (2.51) are unknown, so we get 
an equivalence class of possible states. 
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Simplified parameter estimation 

As the parametrization via the i2-matrix shows, we need to estimate 15 parameters 
to estimate the two-qubit state (the roo element should be 1 for a normalized state). 
By symmetrizing the state, we can estimate the state using fewer parameters. 

Consider the following imaginary symmetrization step. After Alice and Bob 
have received their qubits but before they measure them, Alice chooses two random 
bits b\ and &2 which she sends to Bob. If b\ = 1 they both apply a bit-flip operator, 
a x to the qubit. If 62 = 1 they both apply a phase-flip operator, a z to the qubit. 
They do this to all their qubit pairs and then forget which bits received phase 
flips and bit flips. This kind of symmetrization by randomly applying different but 
correlated unitary operators is called twirling. Their symmetrized state is now 

4m = \ E E WW ® ^WN* 2 ® (2.52) 
61=0 62=0 

This state is invariant under both a x <S> a x and a z <%> a z . We can write out the 
original state p AB using the R- matrix, as in (2.51). By using the commutation and 
anticommutation rules for Pauli operators we see that most of the terms cancel and 
we end up with 

1 3 

4m = 4 E riiUi ® Ui > ( 2 - 53 ) 
i=0 

i.e. the diagonal of the i?-matrix is the same, but the off-diagonal terms vanish. 
Such a state is Bell diagonal (see section 2.1.5). After symmetrizing the state this 
way, it is fully described by the three parameters rn,r22, and r^, which are the 
same in the original state and the symmetrized state. 

In practice, we can effectively apply the symmetrization step by updating the 
measurement results to what they would have been if we had done the symmetriza- 
tion before the measurement. Each qubit will be measured in the x, y, or z basis. 
For qubits that are measured in the x basis, a a x operation before the measurement 
does not change the result of the measurement, since it projects onto |+) and |— ) 
which are eigenvectors of a x . A a z before measurement will give the opposite result. 
Therefore, flipping the measurement result of and x-basis measurement whenever 
b\ = 1 achieves the same effect as symmetrizing before that measurement. Simi- 
larly, measurement results in the y basis are flipped when b\ 7^ 62 and results in the 
z basis are flipped when 62 = 1. This process will decorrelate results in different 
bases since the each result then will be flipped with probability 1/2 independently. 
The measurement results in the same basis will still be correlated, but any bias will 
be removed since both results are flipped together with probability 1/2. 

Since the off-diagonal terms in the i?-matrix vanish for the symmetrized state, 
there is no point in estimating them in the first place. Since we need only the 
measurement results from the same basis to estimate the diagonal elements, we can 
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do the parameter estimation after the sifting. The parameters rn, r 22 and can 
be written as 



r n = 1 - 2Q X (2.54a) 
r 22 = 2Q y — 1 (2.54b) 
r 33 = 1 - 2Q Z (2.54c) 



where 



Q x = J + '-i 9 -'\ (2.55a) 

?+,+ + 9+,- + 9-,+ + 9- - 

<X = g+i, +i + g-v-i (255b) 

9+i,+i + Q+i-i + 9-i,+i + 9-i -i 

Q z = (2.55c) 

90,0 + 9o,i + 9i,o + 9i,i 

are the quantum bit error rates in each basis. Note that we count equal outcomes 
as an error in the y basis, since a perfect channel would give opposite outcomes. 
The symmetrized state is one of the possible states that Eve could give Alice and 
Bob and the symmetrization process will not change the already symmetrized state. 
When only the sifted bits are used in the parameter estimation, there is no way for 
Alice and Bob to tell the difference between a state and its symmetrized version, 
so the symmetrization step does not give any extra power to Eve in this case. 

The Bell-diagonal state estimated from the QBER in the three bases can be 
written as a convex combination of Bell states, 

Psym =Pi\$ + )(* + \ +^|* + >(* + | +p y \y-)(y-\ +p x \Q-)(§-\, (2.56) 

where 

Qx=P y +Pz, (2.57a) 
Q y =Px+Pz, (2.57b) 
Qz=Px+Py, (2.57c) 

and pi +p x +Py+Pz = 1- 

For the BB84 protocol the error rate in the y basis, Q y , is not known so we still 
get an equivalence class of possible states. Having symmetrized the state we only 
have one open parameter compared to seven before symmetrization. 



Identifying a state for each basis 

In the six-state protocol, the state is measured in three different bases. This means 
that there can be different error rates in the raw key coming from different bases 
and also Eve's knowledge about the raw key will be different in the three bases. We 



24 



Chapter 2. Preliminaries 



prefer to standardize the state so that the measured bits are in the computational 
basis. We imagine that the measurements in the different bases is being performed 
by rotating the x basis or y basis to the z basis before measuring in this basis. We 
then get three different states before measurement in the computational (z) basis. 
For the basis rotation we use the unitary operator 



T:=|+)(0|-i|-)(l| = ^= 



1 -i 
1 i 



(2.58) 



This unitary operator has the property that Ta x T^ = a y , Ta y T^ = a z , and Ta z T^ = 
a x . In the y basis, a state with little noise will give anticorrelated results. We 
therefore want to flip the results in this basis. The most straightforward way to 
achieve this is to rotate using T in Alice's system and the complex conjugate T* = 
|+)(0| — i|— in Bob's system. This rotation has the following effect on the 
non-identity terms of Eq. (2.53), 

(T ® T*){a x ® a x )(T ® T*^ = -a y ®a y , (2.59a) 
(T ® T*)(a y ® a v )(T ® T*)t = -a z (8) a z , (2.59b) 
(T®T*)(a z ®a z )(T®T*y = a x ®a x . (2.59c) 

This means that if the i?-matrix of the original symmetrized state is diag(l, r%\, T22, 
r33), the i?-matrix after applying T ®T* once is diag(l, T33, — rn, — 7*22), and after 
applying it twice it is diag(l, — r22, — 1*33, rn). In other words, the expectation value 
in the computational basis, (a z ® a z ) is r33 when measured on p^ a , —^22 when 
measured on (T ®T*)p££jT ®T*)\ and r xl when measured on (T ® T*) 2 p^(T '<8> 
T*) 2 ^. We denote the rotated states by 



p^B = (r® T*) 2 4^(T ® T*f\ (2.60a) 
p f = (T®T*)p* B m (T®T*)\ (2.60b) 
pf B = 4m- (2-60c) 

(2.60d) 

These states will be the starting states which we try to distill a secret key from 
by using advantage distillation followed by other postprocessing procedures. It is 
entirely possible that a secret key can be distilled from only one or two of these 
states. In terms of the measured data, this means that the raw key from one basis 
may have too much error combined with too low secrecy to allow key distillation 
while the raw key from another basis may be distillable. In the analysis we will not 
treat the three states separately, but rather give statements about key distillation 
from a specific Bell-diagonal state. After parameter estimation in the six-state 
protocol it is important to check all three Bell-diagonal states against any distillation 
criterion. 
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The Bell-diagonal state will often be given on the spectral decomposition instead 
of by the i2-matrix. The action of the rotation on the Bell states are 



(T ® T*)|$+) = 


|$+) 




(TC 


§>T*) 2 |$+) 


= 


J 


(2.61a) 


(T® T*)\^ + ) = - 






(TC 


§T*) 2 |* + ) 




J 


(2.61b) 


(T®T*)|¥~) = 


i|$~) 




(T C 








(2.61c) 


(T®T*)|*-) = 


|* + ) 
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5T*) 2 |$-) 






(2.61d) 


So if the estimated state is 
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1 + Pz\ ( $>~ 


-><*-|, 


(2.62a) 


the state from the y and x 


basis are 












pf= Pl \$+}($- 


f | + Pz 
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-)(* + | 


"1 + Py\$~ 


•>(*"l, 


(2.62b) 










1 +^|^" 


•>(*-|- 


(2.62c) 



An example state that can only be distilled in one basis according to condition (8.2) 
in chapter 8 is the Bell-diagonal state defined by (pi,p x ,p y ,p z ) = (f , fl'^n) - ^ ne 
state itself does not satisfy the condition, but when rotated with T ® T* so we get 
the previous y basis in the computational basis, it is distillable. 

In the BB84 protocol, only the x and z basis are used. Instead of imagining using 
the unitary operators T 2 and T to turn the x and y bases into the computational 
basis, we imagine using the unitary and Hermitian Hadamard operator 



H:=|+><0| + |->(1| = ^ 



1 1 
1 -1 



(2.63) 



which interchanges the x and z bases 4 . The effect on Pauli operators is that 

Ha x H^ = a z , Ha y H^ = —<7 y , and Ha z H^ = a x . This gives the following effect on 
the terms in Eq. (2.53) when both systems are rotated, 

(H ® H*)(a x ® a x )(H ® H*)* = a z ® a z , (2.64a) 

(H ® H*)(cj y ® <7 y )(if ® H*^ = a y ® a y , (2.64b) 

(# ® H*)(a z ® ® iT) t = o- a ® o-a,. (2.64c) 

On the Bell states the result is, 

(H®H)\<S>+}= |$+) (2.65a) 

(H®H)\t> + )= |$~) (2.65b) 

(IT®£r)|*-) = -|*-) (2.65c) 

(H ® H)\$~) = |*+) (2.65d) 



4 It would be possible to use T 2 to turn the x basis into the computational basis and use the 
resulting state for checking if key distillation form the x-basis measurement results is possible. 
However, this would complicate the discussion when we soon only use the average quantum bit 
error rate to estimate our state. 
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If the original state parametrized by the i?-matrix is 

(2.66) 

the state after a Hadamard rotation is 

(H H)p^ B m ( H ® #) f = | (1 ® 1 + ras^x ® ^ + r 22 o-„ ® a y + r n a z ® <7 2 ) . 

(2.67) 

Since Alice and Bob cannot estimate r 22 from their BB84 measurements, this is 
an open parameter in both states. When written as a convex combination of Bell 
states, the states are 

pf B = PJ |$+)($+| +p x \y + )(y + \+p y \y-)(i$-\ +p z \$-){$-\, (2.68a) 
(H®H)p^(H®Hy 

= P/ |$+>($+| + p z \^+)(^+\ +p y \^-)(^-\ +p a ,|*-)(*-|, (2.68b) 

where the eigenvalues are not fully determined due to their dependence on the 
unknown parameter r 22 given in Eqs. (2.32a)-(2.32d). 



Fully simplified parameter estimation 

Sometimes it is useful to characterize the quality of Alice and Bob's state using 
only a single parameter, the average quantum bit error rate in the bases that are 
measured. For the six-state protocol this average QBER is Q = (Q x + Q y + Q z )/3. 

By forgetting which basis each of the measured bits comes from, the average 
state is 

AB Pi B +Py B +P^ B , s 

p AB = Fx Hy_ ^_ {2m) 



The i?-matrix can be written as diag(l, r, — r, r) where r = 3(7*11 — r 22 + ^3). When 
written as a mixture of the three Bell-diagonal states in Eqs. (2.62a)— (2.62c), this 
state becomes 



= P/ |$+)($+| + p\^+)(^+\ (2.70) 

where p = (p x + p y + p z )/3 and pj = 1 — 3p. A state of this form is called an 
isotropic state. The parameter p is half the average QBER, p = Q/2. When we 
consider the six-state protocol with a given QBER, this is the starting state. 
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In the BB84 protocol, the average of the two states from Eqs. (2.66) and(2.67) 

is 



where r = (rn+rsa,)/2 = 1 — 2Q and p = (p x +Pz)/2 depends on the open parameter 
T22- We have here an equivalence class of starting states, parametrized by the open 
parameter r^2- If a procedure is to succeed in distilling a secret key, it must distill 
key for all the states in this equivalence class. 

2.2.8 Analysis using coherent bipartite states 

We justified the simplified parameter estimation by showing that even though Alice 
and Bob could not do the symmetrizing operations before measuring the qubits, 
they could update their measurement results to what they would have been if the 
quantum operations had been performed before the measurements. The difference 
would not have any effect on the final measurement results or Eve's knowledge about 
them. This may be seen as an application of the principle of deferred measurement 
from quantum computing [NCOO, GN96]; any measurement during the intermediate 
stage of a computation can be moved to the end and if any of the measurement 
results are used to control further operations, they may be replaced with quantum 
controls. 

The postprocessing that we will analyze in chapters 7-10 in this thesis is purely 
classical and operates on blocks of the bits coming from these measurements. Again, 
we will imagine that we postpone the measurements as far as possible, but since the 
postprocessing involves classical communication we will need to measure in order to 
obtain those classical bits. We will, however, only make a minimal measurement to 
obtain those bits; when a postprocessing step calls for announcing a bit that depends 
on the bit value of several of the bits from the raw key, we imagine computing that 
bit using a quantum circuit and only measuring the qubit that contains the result 
of the computation in the computational basis. 

A similar approach is used when showing the security of QKD protocols by 
showing the equivalence to an entanglement purification protocol [SP00, GL03]. In 
that case the correctness and secrecy of the key follows from the fact that if the 
measurements are postponed until the end of the protocol and all processing is done 
coherently, the states right before the measurement would be maximally entangled 
states (or sometimes other private states [RS07]). In our case we use show that 
the quantum state after the postprocessing steps involving two-way communication 
has finished has a symmetric extension, and therefore no coherent or incoherent 
processing involving only one-way communication can result in a secret key. One 



pA*+{H®H)p™{H®Hjt 




PBB84 — 
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- (1 <g> 1 + ra x (g> a x + r 2 2<7 y <J y + ra z (g> a z ) , 
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(2.71b) 
(2.71c) 
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difference between the two cases is that in a security proof one may give Eve some 
extra power, since that does not weaken the security statement. Since we use the 
existence of a symmetric extension to show that a key cannot be distilled, we must 
be careful to not give Eve access to anything she does not have. In particular, steps 
like the P-step of [GL03] discard qubits which amount to giving them to Eve, since 
we always assume she has the purification of Alice and Bob's state. If a protocol 
calls for discarding qubits, they must still be taken into account when checking for 
a symmetric extension, so we do not distinguish between the qubits. We emphasize 
again that these quantum operations are purely fictional and only serve to show 
that classes of classical processing on classical bits cannot lead to a secret key when 
the Eve has the ability to manipulate quantum systems as she prefers. 

It deserves mentioning that it is possible to take a different path after parameter 
estimation step. Instead of continuing to postpone the measurement and imagine 
doing coherent processing, one can compute the classical-classical-quantum (ccq) 
state [DW04, DW05, HHHO05, KGR05], the state shared between Alice, Bob and 
Eve after Alice and Bob have done their measurements. It is computed by first 
computing the purification of Alice and Bob's (possibly symmetrized) state and 
giving the purifying system to Eve. Then Alice and Bob measure their systems and 
index their classical result by a one-dimensional projector The ccq state is 

then of the form 



The probability pij is the probability for Alice getting measurement outcome i and 
Bob measurement outcome j, and pfj is Eve's conditional state for each case. Any 
processing of this state is now straightforward. Alice and Bob can add systems, pass 
messages to each other, and discard systems and Eve's state must be updated with 
the all communication from Alice to Bob. This class of processing is called LOPC 
for Local operations and public communication. A detailed comparison between this 
class and bipartite LOCC Local operations and classical communication is included 
in [HHHO09]. 

2.3 Semidefinite programming 

We will use semidefinite programming in several places in this thesis. We show in 
section 3.4 how to formulate a 2/c-qubit Bell-diagonal symmetric extension problem 
as a semidefinite program. First we use this in section 4.5.2 to solve the symmetric 
extension problem analytically for (two-qubit) Bell-diagonal states. Then in chapter 
10 we need to test several 2fc-qubit Bell-diagonal states for a symmetric extension 
and we do this by formulating it as a semidefinite program which we can solve 
numerically. 

Every symmetric extension problem can be formulated as as semidefinite pro- 
gram [DPS02, DPS04] and also other subsystem compatibility problems [Hal07] fall 




(2.72) 
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into this category. Semidefinite programming also has applications in many areas 
of engineering [VB96, BV04] . 

2.3.1 Definition 

A semidefinite program (SDP) is a convex optimization problem where we optimize 
over an affine subset ofnxn positive semidefinite Hermitian 5 matrices and the 
objective function is a linear function of the matrix. 

Semidefinite programs can be cast in two forms [BV04, pp. 168-169]. The first 
is the standard form 

minimize tr[CX] (2.73a) 
subject to tr[AiX] = bi, i = l,...,p (2.73b) 
X > (2.73c) 

where C and Ai are given Hermitian matrices 6 , bi are given fixed parameters, and 
X is the Hermitian matrix to be optimized over. The affine subset is here specified 
by the p linear constraints on X, tv[AiX] = bi. 

We can complete the matrices Ai with other matrices Bi such that they together 
form a Hermitian basis for the real vector space of Hermitian matrices. We can 
choose these such that trL4j-Bj] = 0, i.e. they are orthogonal to Ai with the matrix 
inner product so that Ai and Bi span orthogonal subspaces. Then tr[£?jX] =: Xj are 
open parameters that can be changed freely without violating the linear constraints. 
It is possible to write the matrix X as a function of these open parameters, 

p m 

X = j2b i A' i + J2^B' i . (2.74) 

t=i i=i 

where p + m = n 2 (or p + m = n(n + l)/2 for real symmetric matrices). Here, A\ is 
a dual basis of Ai, i.e. a basis such that trL4^Aj] = 5ij and similarly B[ is the dual 
basis of Bi, each on their own subspace. The objective function (2.73a) can then 
also be written as a function of the open variables X{. The matrix C that defines 
the objective function is in general a linear combination of the Ai and Bi that span 
the operator space, 

p m 

C = J2a i A i + J2 c i B i ( 2 - 75 ) 

1=1 i=l 

5 Semidefinite programs are often formulated with real symmetric matrices, but in the context 
of quantum mechanics it is useful to allow complex Hermitian matrices. It turns out that the 
density matrices we want to check for symmetric extension in this thesis are all real, so we only 
really need the real symmetric formulation. 

6 We also assume here that the Ai are linearly independent. If not, either it is not possible to 
satisfy the linear constraints or some of the constraints are redundant and can be removed. 
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We then get 

p m p m 

tv[CX] =J2ai ti[AiX] + Y, c i te[BiX] = a ih + Yl CiXi ( 2 - 76 ) 

i=l i=l i=l i=l 

The first summation here is constant, so we only need to optimize the terms involv- 
ing X{. We then get a semidefinite program on what is called the inequality form, 

m 

minimize CjXj (2.77a) 

i=l 

m 

subject to F(x) := G + ^ XjFj > (2.77b) 

i=l 

Here, G is the first sum in Eq. (2.74), which is a constant matrix, and Fi = B[. 
This semidefinite program is equivalent to the SDP in Eqs. (2.73a)-(2.73c), except 
that the objective function has been shifted by a constant. An inequality of the 
form (2.77b) is called a linear matrix inequality (LMI). 

While the standard form of an SDP parametrizes the linear constraints and 
leaves the rest open, the inequality form specifies a set of open parameters and 
therefore needs no parametrization of the constraints. Both define the same affine 
set of possible matrices, subject to an additional positivity constraint. In both cases 
it is possible to use any operator basis that spans the same spaces as Ai and Fi in 
order to specify the affine set. 

We denote any feasible X that minimizes the objective function (2.73a) by X* . 
Similarly, an x that minimizes the objective function in Eq. (2.77a) is denoted by 
x*. 

If we are only interested in whether a solution that satisfies the constraints 
exists or not, we can set C = in the objective function (2.73a) or all Cj = in the 
objective function (2.77a). The optimization is then trivial. Such an SDP is called 
a feasibility problem. 

2.3.2 Duality 

To each semidefinite program we can associate a Lagrangian [BV04, p. 265]. For a 
problem on inequality form (2.77a)-(2.77b) this is given by 

m 

L(x, Z) := Y ^Xi - tx[F[x)Z] (2.78a) 

i=l 
m 

= ]Tx 4 (q - tv[FiZ}) - tv[GZ], (2.78b) 

i=l 

where Z is a new variable Hermitian matrix called a Lagrange multiplier. 
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From the Lagrangian we get the Lagrange dual function (or just dual function) 
by taking the innmum over all x, 

17\ ■ f T ( 7\ S ~ tT[GZ] fOT tv[m =Ci > (0 7^ 

g(Z) :=xd£L{x,Z) = < . (2.79) 

x I — oo otherwise. 

The dual function gives us lower bounds on the objective function (2.77a). For any 
positive semidefinite Z, we have that tr[i ? (x)Z] > so the Lagrangian (2.78a) is 
less than the objective function in Eq. (2.77a) for any x. Since the dual function is 
the infimum of the Lagrangian it is even less and it is therefore a lower bound on 
the objective function which is independent of the open variables Xj. It is therefore 
in particular a lower bound on the minimal value of the objective function. It is of 
course a useless lower bound for any Z that does not satisfy tr[FjZ] = a. 

The Lagrange dual problem is the problem of maximizing the dual function in 
order to get a lower bound which is as good as possible. It is also a semidefinite 
program and is most easily expressed on standard form with a maximization instead 
of a minimization, 

maximize - tr[GZ] (2.80a) 
subject to tr[FjZ] = Q, i = l,...,p (2.80b) 
Z > 0. (2.80c) 

The dual problem is specified by the same parameters as the original problem (also 
called the primal problem in duality settings) — the numbers Ci and the matrices Fi 
and G. 

The property that the maximum of the dual problem is less than the minimum 
of the primal problem is called weak duality. The difference between Ya=i c i x i 
and —Tr[F{x)Z\ for some feasible x and Z is called the duality gap and is always 
nonnegative. It is equal to the matrix inner product between matrices from the 
primal and dual problem, 

m m 

tv[F(x)Z] = ^Xitr[FiZ] +tr[GZ] = ^c^ - (-tr[GZ]). (2.81) 

i=l i=l 

For most semidefinite programs the optimal duality gap is zero, i.e. the optimal 
objective functions of the primal and dual problems are equal. This property is 
called strong duality. A sufficient condition for strong duality is that either the 
primal or dual problem is strictly feasible, i.e. there exists open parameters x% such 
that F(x) is not only positive semidefinite but also positive definite or Z such that 
tr[FiZ) = a and Z > [VB96, Theorem 3.1]. 

Strong duality does not exclude the possibility that one of the two SDPs are 
infeasible. For example, the primal problem may be strictly feasible, but the mini- 
mization gives — oo (i.e. there is no minimum). In that case there is no maximum 
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for the dual problem. If both problems are strictly feasible, we are guaranteed that 
both optima exist and are equal [VB96, Theorem 3.1]. With a vanishing optimal 
duality gap, 

tr[F(x*)Z*] = (2.82) 
the matrices F(x*) and Z* must reside on orthogonal subspaces, 

F{x*)Z* = 0. (2.83) 

This property is called complementary slackness. It will be very useful in section 
4.5.2 when we solve an SDP analytically. 



Part I 



Symmetric extension and 
related properties 
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Prologue 



There has been an interest for how bipartite quantum states can be part of multi- 
partite quantum states for a long time. A relevant question for computation of 
molecular energy levels fifty years ago was: given certain conditions on the state of 
N particles, what are the possible two-particle density matrices [Cou60, (6) p. 175]. 
When the N particles are fermions, this problem is known as the iV-representability 
problem [Col63] . Different problems relating to the compatibility of density matrices 
on overlapping sets of subsystems with a global state has been studied by several 
authors over the years [Wer90, JL05, BSS06, Liu06, Hal07]. 

The symmetric extension problem is a special class of subsystem compatibility 
problem. In general one may ask for a (n, m)-symmetric extension, meaning that 
we are asking if there exists a state on n copies of system A and m copies of system 
B such that any of the A systems together with any of the B systems has a density 
matrix equal to the given bipartite state. This kind of symmetric extension problem 
can be used to decide if a state is separable or entangled [DPS02, DPS04] and also 
has implications for Bell-inequalities with n settings at Alice or m settings at Bob 
[TDS03]. 

In this thesis we only study the (l,2)-symmetric extension problem where we are 
looking for tripartite extensions, on one copy of system A and two copies of system 
B. Chapters 3 and 4 contain our results for states with a symmetric extension, 
chapter 5 relates the symmetric extension problem to the bosonic and fermionic 
extension problems, and chapter 6 links the results to degradable and antidegradable 
quantum channels. 
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Chapter 3 

Symmetric extension 



3.1 Definition 

Most of this thesis is related to the concept of a symmetric extension. Let us first 
define what we mean by that. 

Definition 1. A bipartite quantum state p AB is said to have a symmetric extension 
if there exists a tripartite quantum state p ABB that satisfies 

tTBl[p ABB' ]=p AB (31a) 
(t A ® P BB ,)p ABB \t A ® P BB ,y = p ABB ' (3.1b) 

where P BB > is the unitary operator that swaps systems B and B' . We may also say 
that a state with a symmetric extension is symmetric extendible. 

In the definition, we have introduced a third quantum system B' . As the name 
suggests, this is of the same dimension as system B. In addition, the swap operator 
P BB i implies that there is an isometry between B and B' (or rather between their 
corresponding Hilbert spaces H B and H B '), so that for any vector in or operator 
on % B there is a corresponding vector or operator on % B i. The swap operator can 
be written out as 

Pbb> = ^2 = ^2 N) O'ls ® \j)(i\B>, (3.2) 

ij ij 

where \i) B and \i) B > are corresponding vectors in the two Hilbert spaces. When 
the swap operator swaps two of many systems, we will often omit the identity 
on the other systems in the notation, e.g. writing only P BB i \'4 > )abb i instead of 
(1^4 (g) P BB ')\i/j)abb' when the operator acts on a tripartite system ABB' . 

The first property, Eq. (3.1a), sometimes called the trace condition, ensures that 
pABB j g rea Uy an extension of p AB and not some unrelated quantum state. The 
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second property, Eq. (3.1b), the swap condition, enforces that B and B' are on 
equal footing, since swapping the two will leave the tripartite state invariant. 

One could imagine using a seemingly weaker condition instead of the swap con- 
dition, Eq. (3.1b). The condition 

tr B ,[p ABB ']=tv B [p ABB '}, (3.3) 

which we can also write as p AB = p AB ' , only ensures that having A and B together 
is equivalent to having A and B' . Note that here we also make implicit use of the 
isometry between B and B' , since we are comparing density operators on different 
systems. For our applications in QKD this is all we need, since it means that an 
eavesdropper in possession of the B' system is in the same position as Bob with 
respect to Alice's system. 

On closer inspection it turns out that the definitions with the two variants 
of the swap condition are equivalent. Given a p AB , let o~ ABB be a state that 
satisfies ti B i[a ABB ] = p AB and tr b'[°~ ABB ] = ^b[o~ ABB ], but not necessarily 
(t A <g> P BB ,)a ABB ' (t A P BB >) ] = a ABB '. The state a ABB ' would then be a valid 
symmetric extension according to the seemingly weaker definition, but not accord- 
ing to the stronger. But a symmetric extension is a property of p AB , not a ABB , 
and a valid extension from both definitions is the symmetrized state p ABB ■= 
(a ABB ' + (1a ® P BB ')cr ABB ' (1 A <8> P BB i) ] )/2. So the state p AB has a symmetric 
extension according to both definitions. Since definition 1 puts more constraints on 
the tripartite state, that makes it easier to look for a symmetric extension or verify 
that none exists. 

Note that a symmetric extension does not mean that the state is supported only 
on the symmetric subspace of % B <g> % B i . One can also ask for such extensions and 
we call them bosonic extensions. A bosonic extension satisfies the stronger one- 
sided swap condition P BB i p ABB = p ABB . Similarly there are fermionic extensions 
that satisfy P BB 'p ABB = —p ABB . Bosonic and fermionic extensions are special 
cases of symmetric extensions and they are analyzed in further detail in chapter 5. 

In this work, we always use the convention that a copy of system B is added. 
Of course this is purely conventional and we could instead add a copy of system A, 
but our convention will be useful when we consider one-way communication from 
Alice to Bob in a QKD setting. In general, it is possible to add more copies to 
both sides. If we look for a state with a total of n copies of A and m copies of B, 
such that it is invariant under any permutation of the A systems or B systems, this 
is called an (n, m) symmetric extension. This concept has been used to derive an 
algorithm for checking if a state is separable [DPS02, DPS04]. In this setting, our 
symmetric extensions are (1,2) symmetric extensions, but since we only consider 
those, we will not write that out. 
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3.2 Properties 

3.2.1 Basic properties 

The set of states with a symmetric extension have some properties that are worth 
mentioning. First of all, the set is convex. If p AB and p AB are states with the 
symmetric extensions p ABB and p ABB , then the convex combination p AB := 
(1 — p)p AB +PP2 B also nas a symmetric extension, namely p ABB> := (l—p)p ABB ' + 
pp ABB • The convex structure means that there are extremal states with a sym- 
metric extension, and we will see in section 3.2.2 and section 3.2.3 that these states 
have some nice properties. 

Another useful property is that the set is closed under 1-LOCC, Local Operation 
and one-way Classical Communication, where the communication flows from Alice 
to Bob in our convention. Even if the operation is allowed to be non-trace-preserving 
(sometimes called 1-SLOCC for Stochastic Local Operation and one-way Classical 
Communication) a symmetric extension cannot be broken when communication 
from Bob to Alice is not allowed. 

Lemma 2. (Nowakowski and Horodecki [NH09]) Let A. be a (not necessarily trace- 
preserving) quantum operation that can be realized with local operations assisted by 
one-way classical communication (1-LOCC), i.e., it is of the form 

A(p) = ® Bij){Ai ® t)p{Ai ® l) f (l (g> B^ (3.4) 

ij 

where ^ i A^Ai < 1 and ^ • B\-Bij = 1 for all i since Bob cannot communicate the 
outcome of a probabilistic operation back to Alice. 

If p AB admits a symmetric extension, then so does A(p AB ). 

An interesting special case is when Alice performs an invertible filter operation 
and Bob performs a unitary. Then the operation can be reversed with nonzero 
probability, so the output state admits a symmetric extension if and only if the 
input state admits one. 

3.2.2 Decomposition into pure-symmetric extendible states 

The convex structure of the set of states with a symmetric extension allows us 
to decompose nonextremal states into convex combination of states with special 
properties. This is analogous to the convex set of separable states. Separable 
quantum states are those states that can be written as convex combinations of 
product states pa ® Pb and they can even be decomposed further into convex 
combinations of pure product states. I.e. 



Psep = ^2Pj\^j)(i'j\ ® \4>j){4>3 
j 



(3.5) 
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Although it can be difficult to determine whether or not a given state can be written 
on this form or not — and if it can, to find some and \4>j) explicitly — the fact 
that all separable states can be written like this allows us to prove properties of 
separable states in general. 

Clearly, it is not true that any p AB that has a symmetric extension can be 
decomposed into pure states with the same property. This is because the only pure 
states that have a symmetric extension are the pure product states, and their convex 
hull is the set of separable states. But it turns out that if we consider the extended 
states — the p ABB that are invariant under exchange of B and B' — they can be 
written as convex combinations of pure states with the same property. In fact, the 
pure states in the spectral decomposition can be chosen to have this property. 

Lemma 3. A tripartite state p ABB ' which is invariant under exchange of B and 
B' , p ABB> = P BB i p ABB ' P BB ,, can be written in the spectral decomposition 

p abb ' = Y J \Mm\ (3.6) 

3 

in such a way that \4>j)(<j)j\ = PBB'\4>j){4>j\PBB'> * ,e - PBB'\4>j) = =M<Aj')- 

P rnn f Q;t^ n ABB ' — P n ABB ' Pt n ABB ' P — P n AB B ' C ^ n ABB ' QT1 rl 

froo]. bmce p — f BB tp ^bb 1 ^ P "bb> — ^bb'P , so p and 
Pbb' (which is shorthand for 1^ (g) P BB i) are commuting diagonalizable operators 
and therefore have a common set of eigenvectors. Since P BB i = I, Pbb' has eigen- 
values ±1 and all its eigenvectors therefore satisfy Pbb'I^j) = ± 1 0j ) • □ 

The above lemma applies to the extended state p ABB ' , but our main interest is 
for bipartite states p AB that admit a symmetric extension. By tracing out the B' 
system we get 

Corollary 4. A bipartite quantum state p AB admits a symmetric extension if and 
only if it can be written as a convex combination 

3 3 

of states p AB which admit a pure symmetric extension. 

Hence, all the extremal states in the convex set of symmetric extendible states 
are extendible to pure states. We will call those states pure- extendible. Note that 
not all states with a pure symmetric extension are extremal. There are states that 
admit either a pure or a mixed symmetric extension. From lemma 3 we know 
that the mixed symmetric extension is a convex combination of pure tripartite 
states that are invariant under swap of B and B' . The original state is then a 
convex combination of the pure-extendible reductions of those tripartite states, and 
is therefore not extremal. Theorem 11 in section 4.2.1 gives a full classification of 
the nonextremal pure-extendible states for the case of two qubits. 
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In the next section, we give a simple necessary condition for a state to be pure- 
extendible. In section 4.2 we show that the condition is also sufficient if and only if 
it is a state of two qubits. 

3.2.3 The spectrum condition for pure-extendible states 

Let X(p) denote the vector of nonzero eigenvalues of p in nonincreasing order. 

Theorem 5. Let p AB be a state that has the pure symmetric extension \4>){^\abb' ■ 
Then 

\(p AB ) = X(p B ). (3.8) 

Proof. Using the Schmidt decomposition with the splitting AB\B' , we can write 
the pure symmetric extension as 

W)abb> = ^2 V^Mi) AB\j) B' ■ (3.9) 

3 

The reduced density matrices of this state are 

3 

i.e. the spectra of p AB and p B ' are equal. By symmetry between B and B' , p B = p B> 
so X(p AB ) = \{p B ). ■ q 

In general, we don't expect all states that satisfy condition (3.8) to have a pure 
symmetric extension (but see Thm. 10 in section 4.2.1). The following corollary 
provides a test that can rule out a pure-symmetric extension. 

Corollary 6. For any state p AB that has a pure symmetric extension and any 
operator M on%A, the (unnormalized) state 

p AB = (M(8) t B )p AB {M® t B ) ] (3.11) 

satisfies condition (3.8). 

Proof. Let \iP)abb' = ^Pbb'I"^) abb' be the pure symmetric extension of pab- The 
filter M acts only on %Ai so it commutes with Pbb>- Therefore M \iP)abb' = 
±MPbs'|V ; ) abb' = ±Pbb' M\ip) abb' ; so M\ip) abb' is a symmetric extension of its 
reduced state pab- Because of theorem 5, pab then satisfies Eq. (3.8). □ 

This condition is useful, since if given a state that is not pure-extendible but 
satisfies condition (3.8), applying a random filter on system A will usually break 
the condition and reveal that it is not pure-extendible. 
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3.3 Symmetric extension for multi-qubit Bell-diagonal 

states 

In many cases the bipartite states that want to check for a symmetric extension 
come from a special class, and this may simplify the problem. Usually, this comes 
about because of some symmetry on the class of states we are considering that 
induces a symmetry on the form of the extended state (should it exist). The states 
that we consider here are states of N qubit pairs in a generalized Bell-diagonal 
state. 

Definition 7. A 2N -qubit Bell-diagonal state is a state of the form 

„AB _ AiBi...A N B N _ \ ^ . \o. . \/o. . I 

(3.12) 

= Pn-iivlAiXAiUiBi ® • • • ® \Pi N )(/3i N \A N B N 

where 

\P h ... lN ) := (lOfffc)®- •• ®(t®a iN )\$ + )® N , :=(t0a, i )\^ + ) (3.13) 

for i £ {0, 1, 2, 3} or equivalently i 6 {/, x, y, z}. 

From Eq. (3.13) we see that we may interpret \^ + ), l^ - ), and |$-) as c x ,a y , 
and a z errors on one of the subsystems that originally started out in the state | < I )+ ). 

We want to decide when states of this form have a symmetric extension. While 
any symmetric extension problem can be formulated as a semidefinite program that 
can be solved numerically for modest dimension [DPS02], we can use the symmetry 
of the problem to simplify it considerably, and even solve it analytically when N = 1 
(see section 4.5). 

3.3.1 Symmetries of the extended state 

A 2A r -qubit Bell-diagonal state is invariant under the following 2A^ + 1 operations: 

(i) a Ai <g> a^* on any subsystem AiBi, 

(ii) a A% (g> erf' on any subsystem AiBi, 

(iii) Transposition of the whole quantum state. 

_ . . . • A Fi R' A R R' A R R' 

l^rom this, we can impose on a symmetric extension p = p^i^i^i'"^^^^— 
should it exist — that it be invariant under 

(i) a A% ® ® a x i on an y subsystem AiBiB[, 

(ii) a Ai ® erf i (g) uf 1 ' on any subsystem AiBiB[, 
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(iii) Transposition of the whole quantum state. 

The reason we can impose this is the following. Suppose that a state p ABB ' = 
p A 1 B 1 B' 1 -A N B N B' N ig a symme t r i c extension of the state p AB = p a i b i- a nB n _ Then, 
applying any of the 2N + 1 above operations to p ABB will give a new (possibly 
different) state a ABB . Since the operation on ABB' reduces to one of the sym- 
metry operations on AB, the new state a ABB will have the same reduction as 
pABB ^ £ r bi \pABB j _ pAB ^ anc i srnce ^he operations on ABB' treat B and B' the 

same way, a ABB inherits the swap symmetry from p ABB . It is therefore another 
symmetric extension of p AB . A third valid symmetric extension is then the state 
Psyn\ = (p ABB +(J ABB )/2 and since all the symmetry operations considered here 
are involutions, this state is invariant under the considered operation. Hence, if 
there is a symmetric extension of a 2iV-qubit Bell-diagonal state, there is also a 
symmetric extension with the imposed symmetries. 

Note that while p AB also is invariant under transposing only a subsystem AiB{, 
it will not always be possible to find a symmetric extension which is invariant under 
transposing AiB{B\. While the operator resulting from transposing a subsystem of 
pABB w -]j j^yg ^g C orrect marginal state and swap symmetry, it may have negative 
eigenvalues and will then not be a quantum state and therefore not a valid symmetric 
extension. 

3.3.2 Imposing the symmetries 

To impose the symmetries on the state p ABB ' it is convenient to express it using 
the Pauli operator basis. Any 3A^-qubit state can be expanded as 

«i-"ijv 

h—w 

Some of the coefficients a^j^... i N j N k N are fixed by the requirement that the state 
be compatible with the given p AB and that it be invariant under swap of B and 
B' . The imposed symmetry simplifies the problem in two ways. First, most of the 
coefficients vanishes. Second, we can reduce the dimension of the matrix involved 
from 2 3N to 2 2N by bringing it to block diagonal form and focusing on a single 
block. 

Open and fixed parameters 

Let us first see how the symmetry constraints on p ABB ' forces most of the coefficients 
a i\jik 1 --i N j N k N to zero. Consider first the imposed constraint that the state p ABB be 
invariant if we apply a Ai <g) a Bi ® a Bi on a given subsystem i. Each term in the sum 
(3.14) will either be left alone or get a negative sign from this operation, depending 
on whether the Pauli operators on subsystem i commute with a Ai <g> a Bi (g> a Bi or 
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not. For example with N = 2, when a A2 a B2 cr B2 ' is applied (i.e. i = 2), the 
term a Al 1.^ <xf 1 c^ 2 cr^ 2 <7:f 2 gets a negative sign since 

(^ 2 C rf 2 C Tf 2, )(^ 2 0^ 2 CT f 2 ')(^ 2 f Tf 2 0af 2 ')t = -<7^®of ®of a '. (3.15) 

This is most easily seen as a consequence of the fact that (a A2 erf 2 erf 2 ) and 
(cr^ 2 (Jy 2 erf 2 ) anticommute. 

The terms that anticommute pick up a negative sign, and since the terms are all 
linearly independent, these terms will have to vanish for the state to be invariant. 
The only combinations of Pauli operators on system i that commute with both 
a x ' a x* ® ^x* an< ^ ^ ' ^ ^* are 

• 10 10 1, 

• all three permutations of 1 a. L <Xj, where the index runs over only x, y and 

z 

• all six permutations of a x ® a y ® a z . 

Therefore, all terms with nonzero coefficient in (3.14) will have one of these 16 
combinations of Pauli operators in each subsystem. We label these tensor products 
of three Pauli matrices Pi, for i £ {1, . . . 16} as indicated in table 3.1. We can then 
rewrite the sum (3.14) by including only the terms that can be constructed from 
the Pauli combinations Pi, 

1 16 

P ABB '=tfN E 7ir~i*^i® (3-16) 

i 1 ---i N =l 

Each of the coefficients Ji 1 -i N is equal to a corresponding coefficient cti 1 j 1 k 1 ...i N j N k N 
from Eq. (3.14). This reduces the number of terms from A 3N to 16^ = 4 2N . 

The operators of the class a x a y a z (i.e. P\\ . . . P\q) pick up a negative sign 
under transposition, so only terms with an even number of subsystems with this 
kind of Pauli combination can have a nonzero coefficient. This ensures that like the 
original state p AB , its symmetric extension p ABB is invariant under transposition 
(i.e. it has only real matrix elements). 

The above reduction in the number of open parameters was only due to the 
symmetries that a symmetric extension must possess. Let us now see what addi- 
tional constraints arises from the criterion that p ABB be a symmetric extension of 
p AB . The first constraint is the trace condition, that tnB'\p ABB ] = p AB ■ Since the 
reduced state p AB is a multi-qubit Bell-diagonal state, it has the form 

p ab = ^nH /v-iX 1 ® < x ® • • • ® %f ® <r> ( 3 - 17 ) 

ii— ijv 
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where the coefficient /3o---o is 1 f° r a normalized state. For a state of the form (3.14) 
to reduce to this, all coefficients that correspond to terms with 1 on the B' system, 
must be equal to the corresponding coefficient for the reduced state, 

Oj 1 i 1 0j2«20---ijvijv0 = fii-ii 2 ---i N • (3.18) 

The other nonzero coefficients are not constrained by this, since all terms which has 
a Pauli operator different from 1 in one of the B\ subsystems vanish when we trace 
over B' . 

The other type of constraints are those we get from p ABB being a invariant 
under swap of B and B' . This means that most of the coefficients have an equal 
partner, which is the one that is obtained by swapping the two last indices in every 
subsystem, 

a hjik 1 --i N j N k N = a hkij\—i N k N j N - (3.19) 

We can translate these conditions to the more economical state parametrization 
(3.16). Only the Pauli type operators P\,P^,P%, and Pi survive tracing out the 
B' system. The trace condition (3.18) now becomes the following. For any 7^...^ 
where all indices are 1,5,6, or 7, 

Ih-iN = Pjl-j N ( 3 - 20 ) 

where j k = i k for i k = 1 and j k = i k — 3 for i k G {5, 6, 7}. The symmetry constraint 
(3.19) gets a little more complicated when expressed in terms of , yi 1 ...i N , 



7h-i N = lh-m where j k = < 



' i k for i k G {1,2,3,4} 
i k + 3 for i k G {5, 6, 7, 11, 12, 13} (3.21) 
i k -3 for i k G {8, 9, 10, 14, 15, 16}. 



These are all the constraints that we can put on the parameters, and those that 
are not explicitly constrained, can take any real value. The symmetric extension 
problem is now to find values for these open parameters such that the resulting 
matrix is positive semidefinite. 



Using lower-dimensional matrices 

The state p ABB ' is a 2 3N x 2 3N matrix, and checking positive semidefiniteness for a 
generic big matrix is not trivial. In this case, we can use the symmetry to simplify 
this part of the problem as well, by identifying a smaller matrix whose positivity is 
equivalent to that of p ABB . 

Since the state p ABB is invariant under o Ai (g> a Bi <S> o Bi , each eigenvector of 
pABB j g g^hgp i n the +1 eigenspace or —1 eigenspace of this operator. The same 
holds for any of the other subsystems AiBiB'^ so each eigenvector has to be in 
one of the 2 N simultaneous eigenspaces of all the N operators a A% (g> a Bi (g> a Bi . 
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Therefore, the state can be written as a direct sum of positive operators on the 
different eigenspaces, 

P ABB '= © Ps. (3.22) 

se{+-} N 

The iih symbol in the TV-symbol string s indicates whether the operator is the pos- 
itive (+) or negative (— ) eigenspace on system i. The operator p^ , for example, 

has its support on the intersection of the +1 eigenspace of cr^ 1 (g erf 1 <g erf 1 and 
the — 1 eigenspaces of er^ 2 <g> erf 2 <g erf 2 and er^ 3 (g erf 3 <g erf 3 . 

Moreover, the state is invariant under a Ai (g erf 4 (g erf*' for all i £ {1, . . . , iV}. 
Recall that the +1 eigenspace of o z (g er z (g er z is spanned by |000), 1 01 1) , 1 101) , 1 110) 
and the —1 eigenspace by 1 1 1 1 ) , 1 100) , 1 010) , |001), i.e. the computational basis vec- 
tors with even and odd Hamming weight, respectively. Applying a a x <g a x (g o x 
operator to any vector in the +1 or —1 subspace will therefore flip it to the other 
subspace. This means, for example, that p ++++ can be taken to the H h sub- 
space by applying a x (g a x <g cr x to the second and third subsystems. Since the 
state p ABB is supposed to be invariant under any such operation, all the p s have 
to be isomorphic, so if one of them is given, the whole density matrix p ABB can be 
reconstructed through the symmetry operations. To verify positivity, it is sufficient 
to check any one of the eigenspaces, since the eigenvalues will be the same on each 
eigenspace. 

To do this in practice, we project the state onto the intersection of all the +1 
eigenspaces of the erf 1 (g erf i (g erf ' operators. For each of the 16 Pauli combinations 
Pi . . . Pi6, we can compute its projection onto the +1 eigenspace of o z (g o z (g a z . 
For example, we can write the Pauli combination P2 out in the computational basis, 
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(3.23) 



The positive subspace is spanned by |000), 1 01 1) , 1 101) , and 1 110) , which corresponds 
to the rows and columns 1, 4, 6 and 7. A projection matrix that projects onto the 
positive subspace is therefore 



1 0' 

1 

1 

1 



(3.24) 
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and we can again write the resulting matrix as a tensor product of Pauli operators, 



= t(g>a x . (3.25) 

When we do this for all 16 allowed combinations of Pauli operators, we get a pro- 
jected operator Qi := P + PiP + for each original operator Pj and the new operators 
that are shown in table 3.1. 

Table 3.1: The independent Pauli terms and their projections to the +1 eigenspace of 
cr z <S> o z ® Ab- 



original Projected 

Pi = 1 ® 1 1 Qi = 1 <g> 1 

P 2 = 1 <8 a x <8 a x Q 2 = 1<S>(T X 

P 3 = 1 <8 a y <8 <T y Q3 = — c 2 cr x 

P4 = 1 <8 o" 2 <t z Q4 = a z 8> 1 

P5 = CTo; ® 1 Q5 

P6 = (Ty <g) (Ty ® 1 Q$ 

P 7 = a z a z 1 Q 7 



P 8 = (Tj ® 1 ® CTj Q 8 = (T x (8 1 

P9 = <8 1 <8 cr y Q9 = -cr x 8) cr 2 
PlO = &z <8 1 (8 cr 2 Q10 = 1 <8 cr 2 



Pu 


= CT^ G 


5 Oy £ 


5> 0^ 


Q11 


= a y$ 


5 0-x 


P12 


= <M 






Q12 


= (Ty <i 


5 0" 2 


Pl3 


= o" 2 5 


5 da; (J 




Ql3 


= 1(8 


) Gy 


Pl4 


= CTx G 


5 cr 2 £ 


$a v 


Qu 


= °V 


8 1 


Pl5 


= "V ^ 




5> cr 2 


Q15 


= cr x £ 




Pl6 


= 1? 




5 0"x 


Qm 


= cr* ^ 


5o-„ 



Q-2 



P+P<?PI 



0100 
1000 
0001 
0010 



= <J X (8 a x 

= Oy (8 CTy 

= (T Z ®(T Z 



The projected operators Qi can be substituted directly for the original operators 
Pj in each term of the expansion (3.16) in order to obtain |_, 

1 16 

P++-+ = 7}W Yl lh-i N Qii®---®QiN- ( 3 - 26 ) 

If we can assign values to the open parameters such that the projected matrix |_ 

is positive semidefinite, the same values will give a valid symmetric extension of p AB 
when the original three Pauli operators Pi are used in each term of Eq. (3.26). 

Having used the symmetry to reduce the number of open parameters and di- 
mension of the matrix for which we need to ensure positivity, we list the number of 
open parameters and matrix dimension with and without symmetry in table 3.2. 
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Table 3.2: Number of open parameters and dimension with and without symmetry. 





without 


symmetry 


with 


symmetry 


qubit pairs 


# of open params 


dimension 


# of open params 


dimension 


1 


48 


8 


3 


4 


2 


3840 


64 


60 


16 


3 


258048 


512 


1008 


64 


4 


16711680 


4096 


16320 


256 



3.3.3 Using additional <S> S symmetry of the reduced state 

We will be particularly interested in finding a symmetric extension for 2iV-qubit 
Bell-diagonal states that have an additional symmetry, namely that swapping a x 
errors and a y errors in any of the subsystems leaves the state invariant. In other 
words, for any qubit with a bit error, the probability of having a phase error is 
1/2. The symmetry operations related to this is S^ ® S where the unitary operator 
S := |0)(0| + i|l)(l| is called the phase gate. Since S 2 = (S^) 2 = a z , this symmetry 
implies the a z ® a z symmetry that we have for all Bell-diagonal states. Since Alice 
and Bob's state is invariant under the operation 

(iv) s\. ® S Bi 

on any subsystem A{Bi, 

we can impose that the extended state be invariant under the operation 

(iv) S^ A , ® ® on an Y subsystem AiBiB^,. 

Since S is diagonal, it commutes with both the diagonal matrices, 1 and a z . 
For the a x and a y matrices, the relevant relations are 

a y , (3.27a) 

-<r x , (3.27b) 

-a y , (3.27c) 

a x . (3.27d) 

This means that some of the coefficients in (3.14) and (3.16) have to be equal. The 
operation S>®S®S takes 



A 


= l®a x 


®a x -k+ 


1c 




)(Ty ~- 


= A, 


A 


= cr x 


g) o x <2> 1 <H> 


-a v 


® a y ( 


E> 1 = 


= "A, 


A 


= °x 


g> 1 ® a x •<->■ 


-<Ty 


<g> 1 <S 


)(Jy ~- 


= "A, 


Pn -- 


= Ox £ 


)<Ty 


<8> o z 


Oy 


(g) a x 


8> cr* 


= As, 


Pl2- 


= (Ty<S 


) a z 






® a z 




= A.4) 


Pl3- 


= a z ig 


) cr x 


<8> CJy 


-cr z 


<8> a y ( 


8 0":r 


= -Pl6 



Sa x S> = 
Sa y S^ = 
S^a x S = 

S^fJyS = 
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and the other combinations Pi are invariant (note that S^giS^S is not an involution, 
but its square is o z o z o z and all the Pj are invariant under that). This means 
that instead of building the extended state from the 16 Pauli combinations Pi listed 
in table 3.1, it is sufficient to use the 10 combinations Ri from table 3.3, so that we 
get a sum of the form 

1 10 

p ABB ' = ^n E £i,-i N Ri,®---®Ri N . (3-28) 

il---ijv=l 

This takes the number of terms to consider from 16^ without the S S 
symmetry to 10^ when we include it. 

Table 3.3: Independent Pauli terms with (& S <E) S symmetry, both in original form and 
projected to the +1 eigenspace of <r z ® a z . 





Original 








Projected 






Rl = 1 1 1 








T x = 1 1 




R2 


= 1 o x o x + 1 o y Q 


lOy 


T 2 


= 1 CTa; - O z (g 


) cr x 




R 3 = 1 a z o z 








T 3 = o z ®l 






= o x o x 1 — o y 


Oy 


1 




= cr x o x - o y C 


$Oy 




#5 = 0"2 1 








r 5 = C7 2 CTz 




Rq 


= <T X 1 o x - o y 


la 




n 


= CTj; 1 + CTjj; g 


) CT Z 




i?7 = <7 2 1 O z 








T 7 = 1 ct z 




Rs -- 


= X (g) Oy (g) O z + Oy ® 


Ox 


o z 


T 8 -- 


= (T y cr^ + <7 X t 




Rg - 


= Oy (g) Z & O x + X ® 


cr z 


Oy 


n 


= Oy (g O z + Oy ' 


8) 1 


Rio 


= cr z o x cr y - o z (g 


)Oy 


CTj; 




= 1 Oy - Z $ 





All the operators Ri in table 3.3 are invariant under S 5. 

Under swapping the last two qubits, R\, i?2, R3, R5, and R7 are invariant. The 
operator R4 becomes Rq and vice versa, and the same holds for Rg and Rg. The 
last operator, R\o acquires a negative sign when the two last qubits are swapped. 
These relations define pairs of coefficients Cii— % that have to be equal in the sum 
(3.28). 

As before, we can substitute the operators Ri on the full Hilbert space of ABB' 
with the projected operators Tj when we check for positivity, 



P++-+ = Yl &i~iN T h ® ■■■®T iN . (3.29) 

«i"-ijv=l 
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3.4 The symmetric extension problem as a semidefinite 
program 

The symmetric extension problem can be cast in the form of a semidefinite program 
(SDP) [DPS02, DPS04]. By determining the open and fixed parameters of the 
extended state 

pABB' in 

section 3.3.2 we have already informally formulated the 
symmetric extension problem as a feasibility problem (see section 2.3.1) — an SDP 
on the inequality form (2.77a)-(2.77b) with all Cj = 0. With the minimization 
gone we are only left with finding open parameters x% such that the linear matrix 
inequality from Eq. (2.77b), 

m 

F(x) :=G + J2xiF t >0 (3.30) 

i=i 

is satisfied. 

The matrix F(x) in represents the extended quantum state p ABB ' , parame- 
trized as in Eq. (3.14), except that we omit the normalization factor 1/2 3N so that 
tr[i ? (x)] = tr[l] = 2 3N . At this point, the normalization factor does not make a 
difference, since it does not affect the semidefiniteness of F(x). There is one open 
parameter Xi for every independent open coefficient (some of the cti 1 j 1 k 1 -i N j N k N 
have to be equal because of the swap symmetry), and the corresponding F{ is sim- 
ply the sum of those af 1 ® of 1 <g> af ® • • • (g> af N ® af N <g> a B N that correspond 
to that open coefficient. Those of the cti 1 j 1 k 1 --i N j N k N that are fixed by the require- 
ment that the state reduce to p AB when B' is traced out are summed with the 
corresponding Pauli operators in the fixed matrix G. 

This approach works even if there are no symmetries, but as we saw in section 
3.3.2 the symmetry requirements fix a lot of the otherwise open parameters so that 
the search space gets smaller. When we have the additional ® S symmetry we 
can also lump together many of the previously independent open parameters into 
one open parameter to further reduce the search space as described in section 3.3.3. 
This means that each Fi will have a greater number of Pauli terms. 

As described in section 3.3.2, positivity of the matrix on a subspace is sufficient 
to ensure positivity of the whole matrix due to the Bell-diagonal form of the state. 
In the semidefinite program this means that all the F^ can be substituted for smaller 
matrices generated by using the projected forms of the Pauli operators from table 
3.1 (without S*<g>S symmetry) or table 3.3 (with S'®S symmetry). 

The feasibility problem only tells us whether or not the problem is feasible, 
i.e. if the state has a symmetric extension. By modifying the SDP slightly we can 
introduce an objective function whose optimal value will give us an indication of 
how far away the state is from losing or gaining a symmetric extension. For this, 
instead of the fixed parameter aooo—ooo we use t + «ooo---ooo where t is a new open 
parameter. aooo---oool" 4B ' B is still a part of G while tt ABB is one of the XiFi terms 
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in Eq. (3.30). Let this be x\F\. We then also let c\ = 1 (with all other a = still), 
so that the objective function becomes simply t. 

This makes sure that the problem is always feasible — if e m i n is the (negative) 
minimum eigenvalue of some matrix F(x), then adding |e m j n | to t will make the 
matrix positive semidefinite. Moreover, if the minimum value of t is greater that 0, 
it means that the state cannot have a symmetric extension, since a valid quantum 
state would have t = and satisfy the positivity constraint. If the minimum is less 
than 0, we can get a symmetric extension by setting t = and leaving the other 
open parameters unchanged. This adds some fraction of 1 to a positive matrix so 
the resulting matrix that represents a trace-1 quantum state (when aooo-ooo = 1 as 
it should be for a normalized quantum state) is still positive. 

The semidefinite program now takes the form 

minimize t (3.31) 
subject to 2 3N p{a) := ^ a ^ a + ^ a^a + tl>0. (3.32) 

Here, rfi xe d is the set of a^...^ that are fixed by the partial trace condition, r ope n 
is the set of independent open parameters, and S a is the set of af^ ® a^ 1 ® a^ 1 

that correspond to the independent parameter 



'ki 

a. 
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Chapter 4 



Symmetric extension of 
two-qubit states 

4.1 Conjectured formula 

In the previous chapter, we have found some properties of the states with a sym- 
metric extension, but none of them will tell us directly if a state has a symmetric 
extension or not. If we restrict our attention to the simplest possible bipartite 
quantum system — two qubits — we can get stronger results. For many classes of 
two-qubit states we can derive formulas for when they have a symmetric extension. 

The situation is analogous to the separability problem. Like the set of states 
with a symmetric extension, the set of separable states is convex, and the extremal 
states (pure product states) are easier to deal with than general separable states. 
For systems of dimension 2x2 and 2x3, the PPT criterion [ref Peres] is a necessary 
and sufficient condition for separability [ref Horodeckis]. If all the eigenvalues of 
(p AB ) r (where T denotes a partial transpose) are nonnegative, then we know that 
the state is separable, otherwise it is entangled. We know that looking only at 
the eigenvalues of p AB together with its reductions p A and p B is insufficient to 
determine separability [NK01], even if we restrict our attention to two qubits.. 

For symmetric extension of two-qubit states we think the situation is a little 
different. Like for the separability problem, a simple formula is enough to determine 
whether a two-qubit state has a symmetric extension or not, but looking at the 
eigenvalues of p AB and p B seems to be sufficient. We propose a formula based 
only on these eigenvalues that we conjecture determines if a state has a symmetric 
extension. We can prove the formula only in special cases and this will be done in 
the rest of this chapter after strengthening some of the results from the previous 
chapter for the case of two qubits. 

Conjecture 8. A two-qubit state p AB with reduced state p B has a symmetric ex- 
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tension if and only if 

tr[( P B f] > tr[{ P AB f] - 4^/detGO. (4.1) 

The conjecture has received extensive numerical testing and no counterexamples 
were found. 

In the rest of this chapter we first specialize and strengthen the results from 
section 3.2.3 for states with a pure symmetric extension. Then we use this and 
other results from the previous chapter to derive conditions that are equivalent to 
Eq. (4.1) for Bell-diagonal states, rank-2 states, a subset of the states invariant 
under a z ® a z , and states with support only on the symmetric subspace. 



4.2 Pure-extendible states of two qubits 

4.2.1 Spectrum condition is sufficient for two qubits 

In this section it is shown that if p AB is a two-qubit state and satisfies X(p AB ) = 
X(p B ), then there exists a pure state \i^)abb' such that \iP)abb' = Pbb'W) abb 1 ■ 
We first start by giving an equivalent condition to the spectrum condition. 

Lemma 9. Given a bipartite state p AB . Then X(p AB ) = X(p B ) if and only if 
there exists a pure tripartite state \iP)abb' with reductions p AB , p B and p B where 
p B = p B> . 

Proof. Assume X(p AB ) = X(p B ) = (Xj). We can write the states in the spectral 
decomposition, p AB = Xj\<pj)(tpj\, p B = J2j ^j\bj)(bj\- Then, a purification of 
p AB is 

W)ABB' 



Y,y^\^)AB\bj) B '- (4.2) 

i 

Tracing out the AB system we get p B> = \j\bj){bj\ = p B . 

Conversely, assume that there exists a pure tripartite state \i^)abb' which has 
the given p AB as a reduction and that the reductions of \iP)abb' to B and B' satisfies 
p B = p B . The Schmidt decomposition with the AB\B' splitting of the state \ ip) abb' 
takes the form (4.2), where Xj and ^ • Xj\(pj)(<pj\ must be the eigenvalues and 
eigenvectors of the given p AB . The reduction of \iP)abb' to B' is p B> = ^ ■ Xj\bj)(bj\. 
Since p B = p B ' this is also the reduction to B, so p B has the same spectrum as 
p AB . □ 

In other words, the spectrum condition X(p AB ) = X(p B ) means that there exists 
a pure extension of p AB to \i/j)abb' such that the reduced states on B and B' are 
equal. Note that it is not guaranteed that the reduced state on AB is equal to the 
reduced state on AB' which would be necessary for a pure symmetric extension. 
The following theorem says that for a two-qubit system, we can also find a proper 
pure symmetric extension whenever the spectrum condition is satisfied. 
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Theorem 10. For a two-qubit state, X(p AB ) = \{p B ) is a necessary and sufficient 
condition for it to have a pure symmetric extension. 

Proof. The condition is necessary for any dimension and this is already dealt with 
in section 3.2.3. Here, we only prove sufficiency for two qubits. By lemma 9, the 
condition implies that there exists a purification \iP)abb> of p AB which is such that 
p B = p B . We will prove that for such a pure state, there is always a unitary 
operator on the B' system alone that will make it symmetric between B and B' . 

First, we prove the special case when p B is completely mixed. Then p BB = 
tr^[|?/;)(V>|ABB'] is a state with maximally mixed subsystems. For such a state, 
there exist local unitary operators Ub, Vb 1 such that (Ub <8> Vs')p BB (Ub® Vb>) is 
Bell-diagonal [HH96]. Moreover, since A is a qubit, Pbb' is of rank-2 and we have 

{U b ®V b >)pbb>{Ub®Vbi) ] =p|V>i)(V<i| + (1 - p)|V>2>(M (4.3) 

with |t/>i) and \ip 2 ) two of the four Bell-diagonal states = (|00) ± |ll))/\/2, 

\^^} = (|01) ± 1 10))/ \/2. Since the Bell-basis can be permuted arbitrarily with local 
unitary operators [BDSW96], we can choose Ub and Vb> such that |^i) = |<3? + ) and 
\ip2) = \^~), so that we avoid the antisymmetric state \^~). The state in Eq. (4.3) 
can now be purified to y/p\Q) a\^ + ) bb' + \/l — p\^)a\^ )bb'- Since all purifications 
of a state are equivalent up to a local unitary on the purifying system — in this case 
A — this is related to the pure state that we started out with as 

(T a ®U b ®Vb>)\i/>)abb> 

= Vp\0)a <8> \$ + )bb> + ^/1-p\1)a ® \&~)bb>, (4-4) 

where Ta is the unitary operator on A that relates this purification to the one where 
A is left unchanged. We now perform the unitary Tjj (g> U B ® U* B , on the state, and 
a unitary of this form will not change the symmetry between B and B' . This gives 

{I a ®Ib®U b V b <)\iI>)abb> = (T\®U B ®U B ,)x 

{^\Q)a ® \$ + )bb> + V 1 -pWa ® |*~)bb')- (4-5) 

From this we can conclude that performing the unitary U^V on system B' will 
take the starting state \i^)abb' to a symmetric one, so the state p AB has a pure 
symmetric extension. 

We now consider the generic case when the reduced state p B is not maximally 
mixed. In this case, the two nondegenerate eigenvectors of p B provide a preferred 
basis for Ub and the corresponding basis in Ub' is an eigenbasis for p B . By 
choosing the bases in this way, we make sure that p B = p B are diagonal. 

An arbitrary state vector of the system ABB' can be written as 



a|000) + 6|001) + c|010) + d|011) + e|100) + /|101) + g|110) + h\lll), (4.6) 
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where a, . . . ,h are complex numbers whose absolute square sum to 1. It is symmetric 
under permutation of B and B' if b = c and / = g. 

The two reduced density matrices of the generic state are in the computational 
basis 



e\ 2 + \f\ 2 ac* + bd* + eg* + fh* 
a*c + b*d + e*g + f*h \c\ 2 + \d\ 2 + \g\ 2 + \h\ 2 



|a| 2 + |6| 2 + 



Ial 2 + 



Icl 2 + 



e\ 2 + \g\ 2 



ab* + cd* + ef* + gh* 
a*b + c*d + e*f + g*h \b\ 2 + \d\ 2 + |jf + \h\ 2 



(4.7) 
(4.8) 



On these matrices we will impose that they are equal and diagonal, since we can 
achieve that by choosing the eigenvectors of p B and p B as bases. In the next 
paragraphs, we show that this implies that 



\b\ 

l/l 



l c llfl 



l c l> 
\9\, 

=) _ J{<i>f-<t>g) 



0. 



(4.9) 
(4.10) 

(4.11) 



We then show that a unitary operator from Eq. (4.20) or Eq. (4.21) can be applied 
on B' to give a pure symmetric extension, i.e. a state vector with b = c and / = g. 
The equations we get from imposing that p B and p B are equal and diagonal are 



|6| 2 + l/| 2 = |c| 2 + M 2 , (4.12a) 
ac* + bd* + eg* + fh* = 0, (4.12b) 
ab* + cd* + ef* + gh* = 0, (4.12c) 

where the first is from the diagonal entries of p B being equal to those of p B> and 
the others from the off-diagonal elements being 0. 

First we show that unless |6| = |c| and |/| = |<?|, ps has to be maximally mixed. 
For a contradiction, assume that |6| ^ |c|. Then by (4.12a) also |/| 7^ \g\. From 
(4.12b) and (4.12c) one can then isolate e and h*: 



a(b*f-c*g) + d*(cf-bg) 

\g\ 2 -\f\ 2 

a(c*f* -b*g*) + d*(bf* -eg*) 



(4.13a) 
(4.13b) 



m 2 -i/i 2 

From this one can compute |e| 2 — \ h\ 2 and by using (4.12a) this simplifies to 

| e | 2 - \h\ 2 = \d\ 2 - \a\ 2 . (4.14) 

Taken together with (4.12a), this is exactly the condition that the two diagonal 
elements in p B and p B are equal, so the the subsystems must be completely mixed. 
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Since the subsystems are not completely mixed, we have a contradiction and we 
must have \b\ = |c| and |/| = \g\. This shows that the absolute values of the 
relevant amplitudes are equal. 

Now we want to find the relations between the complex phases of 6, c, / and g. 
Denote b = \b\e i<t>b , c = |c|e i<fc , / = |/|e i( ^ and g = \g\j*<> . Multiplying (4.12b) by 
g, (4.12c) by /, taking the difference, and using |/| = \g\, we obtain 

a(c*g-b*f) + d*(bg-cf) = 0. (4.15) 
Since |c||g| = |c||/| = = \b\\g\, this becomes 

^\c\\g\{ae-' l(t,b + d* ' & ^^{<t> b -<t>o) _ e i(*/-*,)) = . (4.16) 
At least one of the following two equations must then hold. Either 

\c\\g\ Ufa-**) - ji+f-M} = o, (4.17) 
which will be a useful relation, or 

oTe^ = -ae'^K (4.18) 

In the case that (4.17) does not hold, (4.18) must hold, and we will first see that 
this leads to a contradiction, since it implies that subsystem B is completely mixed. 
If we insert (4.18) into (4.12c) and use \b\ = |c| and |/| = \g\, we obtain 

h*g = -ef*. (4.19) 

Since (4.17) does not hold, |/| = \g\ ^ and therefore (4.19) implies |e| = \h\. The 
condition (4.18) already means that \a\ = \d\, so again we have that (4.14) holds so 
the diagonal terms in p B are equal and we are in the maximally mixed case. 

Since it leads to a contradiction if (4.17) does not hold, we have that (4.17) 
must hold. So while the absolute values of the relevant amplitudes are equal, the 
complex phases might be different. This can be corrected with a phase gate on B' 
as follows. If b = c = 0, the unitary operator on B' , 

U B , = |0)(0| + e- i{ ^-^ ) |l)(l| (4.20) 

will correct the phases so that f = g, and if / = g = 

U B , = |0)(0| +e- i( ^-^ ) |l)(l| (4.21) 

will make sure that b = c. If none of the relevant amplitudes are zero, Eq. (4.17) 
implies that the two expressions are equal, so the same unitary operator will correct 
both amplitude relations. We can therefore always apply a unitary operator to B' 
to obtain pure tripartite state of the general form (4.6) with b = c and / = g. 

Hence, for two-qubit states p AB that satisfy the spectrum condition (3.8), we 
have shown that there exists a pure state vector \iP)abb> which is symmetric, 
\i>)ABB' = Pbb'\iP)abb>- □ 
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This theorem, together with corollary 4 (section 3.2.2), fully characterizes the 
set of two-qubit states with a symmetric extension. It is the convex hull of the 
set of states that satisfies condition (3.8). Not all the states that satisfy Eq. (3.8) 
are extremal for the set of states with symmetric extension, however. While any 
pure-extendible states that is itself pure (i.e. a product state) is extremal for both 
the set of states and the subset of extendible states, there are some mixed pure- 
extendible states that are not extremal. The following theorem characterizes the 
mixed nonextremal pure-extendible states of two qubits. 

Theorem 11. For a two-qubit state p AB which is mixed and pure-extendible the 
following are equivalent: 

1. p AB can be written as a convex combination of other pure-extendible states 
(i.e. it is not extremal) 

2. p AB is separable 

3. p AB is of the form 

p AB = A^oOXVoOl + (1 - A)|Vil>(Vil|, (4.22) 
where (0|1) = 0, (V'olV'i) arbitrary and < A < 1. 

Proof. 3 2 is trivial as the state in Eq. (4.22) is a convex combination of two 
product states. 2 =>• 1 is also trivial, since any mixed separable state can be decom- 
posed into a convex combination of pure product states pab = Pj\'4>j4>j}(' t Pj4'j\ 
and the product states have the pure symmetric extension IV^aI^bI^b'- 

The only nontrivial part is 1 3. For this part, assume that p can be written 
as a convex combination of other pure-extendible states, 

3 

where p AB and all p AB satisfy the spectrum condition (3.8). Tracing out A gives 

P B = Y,PiPf- ( 4 - 24 ) 

3 

Since p AB has support on a 2-dimensional subspace, the support of the p AB must 
be on that same subspace. We can parametrize the states on AB by Pauli operators 
ts,T, x ,T, y ,T, z on this 2-dimensional subspace, 

p AB = l(l s + X-Z x + YjZ y + Z^ z ) = i(l s + R ■ E). (4.25) 

Note that the Is here is not the identity on the 4-dimensional Hilbert space of the 
system AB, but a projector to the 2-dimensional support of p AB . The reduced 
states on system B can be written as 

Pf = \( 1b + x 3 ax + y 3 a y + z 3 a z) = \( 1 B + r- oO, (4.26) 
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where a x ,a y ,a z are the Pauli operators on the qubit B. Similarly, we can write 
pj B = (l s + Rj ■ S)/2 and pf = (1 B + fj ■ a)/2. In this representation, Eq. (4.23) 
and Eq. (4.24) becomes R = ^2jPjRj and f = YljPj^j- 

The eigenvalues of p AB and p B are determined by the length of the vectors R 
and r, 

A(/ B ) = ^(1 + 1^1,1-1^1), (4.27) 
Kp B ) = \(l + \f\,l-\f\). (4.28) 

The pf B and p AB are pure-extendible, so they satisfy condition (3.8). In terms of 

the above parametrization, this means that \Rj\ = \fj\ and \R\ = \f\. 

Since tracing out a part of a quantum system never can increase the trace 
distance between the states [Rus94], we have 

\\pf B -p AB h>\\pf-pni- (4-29) 

The trace distance can be written in terms of Rj and fj as \\p AB — p AB \\i = \Rj — Rk\ 
and \\p B — p B \\i = \ fj — fk\- From \Rj — Rk\ 2 > \fj — fk\ 2 we get 

l^f - 2Rj ■ R k + \R k \ 2 > \fj\ 2 - 2fj ■ f k + \r k \ 2 , 

and since \Rj\ = \ fj\, this gives 

Rj ■ Rk < fj ■ fk- (4.30) 

Now we can use = \f\ and Eq. (4.30) to show that when p AB is a pure- 
extendible state, the trace distance between the p AB does not decrease when system 
A is traced out. 



\R\ 2 = (J2pA) (Y,PkRk) (4-31) 

j k 
j j<k 

\f\ 2 = ^Pjlfjl 2 + 2y~]pjp k fj ■ f k (4.33) 

3 3< k 



so by demanding = |f| and using \Rj\ = \fj\, we get 



y^PjPkRj ■ Rk = y^PjPkfj ■ fk- (4.34) 

j<k j<k 
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By Eq. (4.30) none of the terms on the LHS can be greater than the corresponding 
term on the RHS. The only way for this to be satisfied is that 

Rj ■ Rk = fj ■ f k , (4.35) 

for all pairs (J, k). By reversing the calculation leading to (4.30) we get that \Rj — 
R k\ 2 = \rj - f k \ 2 and 

\\Pj ~ Pk 111 - \\Pj ~ Pk 111- {4.6b) 

The next step is to use Eq. (4.36) to find the structure of the support of p . 
The difference p AB — p AB must be on the same two-dimensional subspace that all 
the p AB are confined to. Being the difference between two operators with trace one, 
it is also traceless, so in the spectral decomposition it can be written as 

Pf ~ Pi 3 = rl^+XV+l " r|V-XV>-l (4.37) 

for some r > 0. The orthogonal vectors |VM-) an d \ip—) define the two-dimensional 
support of p^ B and p AB . From Eq. (4.36) and taking the trace norm of both sides 
of Eq. (4.37) it is clear that \\pf - p B \\ x = 2r. 

Let p B = trA\i^+)(ip+\ and p B = tiA \ip-)(ip-\- Tracing out the A system in 
Eq. (4.37) and taking the trace norm gives r\\p B — p B \\i = \\p B — P B \\i = 2r, or 

||^-p B ||i = 2. (4.38) 

This is the maximal distance between two states in trace norm, and it means that 
p B and p B have support on orthogonal subspaces. Since B is a qubit, p B and p B 
must be orthogonal pure states which we denote p B = |0)(0|, p B = |1)(1|. This also 
means that \ip+) and are product states, 

|^+) = |^)®|0), (4.39) 
|^_) = |^i)®|l), (4.40) 

where |^o) and are arbitrary. 

Any state on the subspace spanned by 1-0+) and \ip-) can be expressed as 

l 

P AB = Yl Pmn\ll>m){ll>n\®\m){n\, (4.41) 
m,n=0 

with the reduced state being 



P B = Yj Pmn(4>n\lpm) ®\m)(n\. (4.42) 
m,n=0 
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Figure 4.1: Examples of tripartite states states where pab satisfies the spectrum condition 
(3.8), but does not have a symmetric extension. The 4x2 state from example 12 on the 
left and the 3x2 state from example 13 on the right. 

Since p AB is pure-extendible, it satisfies Eq. (3.8) and for qubits this is equiva- 
lent to the condition that the purities of the global and reduced states are equal, 
tr[(p AB ) 2 } = ti[(p B ) 2 }. The purities are 

ti[(p AB ) 2 } = plo + pi, + \poi\ 2 (4.43) 

M(P B ) 2 ] =P 2 00 + pIi + \Poi\ 2 \(M4>i)\ 2 - (4-44) 

For the purities to be equal, either poi = or | (V'ol^i)! = 1- 111 the nrs t case, the 
state would be 

p AB = Poo|^oO)(VoO|+pu|Vil)(Vil| (4-45) 
which is the sought separable form. In the other case \ipo) and only differ by 
a phase, so all states in the subspace are product states of the form \ipo)(' l Po\ ® P B 
which is the special case of Eq. (4.45) where | V^o) = l^i)- D 

4.2.2 Spectrum condition is not sufficient for any higher dimension 

In the previous section, we have seen that the spectrum condition (3.8) is not only 
necessary but also sufficient for the state to have a pure symmetric extension when 
the system considered is a pair of qubits. One may ask if the same might be true 
for any higher dimensional system. We show some counterexamples that exclude 
this possibility for any dimension greater than 2x2. 

Example 12. (4 x 2). The simplest example is when Alice holds two qubits and 
Bob one. One of Alice's qubits is maximally mixed, while the other is maximally 
entangled with Bob's qubit. 

p MMB = !^®|$+><$+U 2B (4.46) 

The global density matrix p A ^ A ^ B has nonzero eigenvalues {1/2,1/2}, and so has 
the local one p B . The state therefore satisfies the spectrum condition \(p AlA2B ) = 
X(p B ), but does not have a symmetric extension, since by tracing out A\, Alice can 
make a pure maximally entangled state. The purification of the state is illustrated 
in Fig. 4.1. 
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While the above example is conceptually simple, it does not exclude that the 
spectrum condition could be sufficient when Alice holds a qutrit. The following 
example is similar in spirit to the above, and shows that for system of size 3x2 
and higher, the spectrum condition cannot be sufficient. 

Example 13. (3 x 2). Consider the (unnormalized) vectors of a tripartite system 

\ Vl ) = |001> + |211), (4.47) 
\v 2 ) = |110) + |211), (4.48) 

where the registers are A, B and B' . The vectors are illustrated in Fig. 4.1, the solid 
line corresponds to \v\) and the dashed line to \v2). The vector \v\) is entangled 
between A and B, while \v%) is entangled between A and B' . Interchanging and 
1 at A and swapping B and B' , takes \v±) to \v2) and vice versa. Adding the two 
vectors and normalizing gives the state 

|V) = ~|001) + -i=|110) + yl |211). (4.49) 
The reduced states are 

P AB = l\iP 1/5 )(iP 1/5 \ + l\ll)(ll\, (4.50) 
p* = j||l)<l| + I|0><0|, (4.51) 

where 



1^1/5) = 




(4.52) 



The nonzero eigenvalues are the same for p and p , so p satisfies the spectrum 
condition. However, it does not have a symmetric extension. This is most easily 
seen by applying the filter F = |0)(0| + |2)(2| to A. This succeeds with probability 
5/6 and the state after the filter is the pure entangled state IV1/5), which has no 
symmetric extension. 

Both examples above are states that can be extended to states that are invariant 
under some Ua <8> Pbb 1 ■, where Ua is a unitary on A, but not under 1^ ® Pbb 1 ■ For 
the 4x2 case, Ua was the unitary swapping A\ and A2, while in the 3x2 example it 
was |0)(1| + |1)(0| + |2)(2|, a unitary swapping the basis vectors |0) and |1). One can 
use the same arguments as in the proof of theorem 5 to show that any pure state 
that has a symmetry of the type Ua <8> Pbb 1 has a reduction to AB that satisfies 
the condition (3.8). 

The above examples show that the condition (3.8) cannot be sufficient for pure 
extendibility for M x N systems where M > 3 and N > 2. This leaves open the 
question whether it is sufficient for 2 x N for any N > 2. We therefore now give 
an example of a class of states with system dimension 2x3 that satisfies condition 
(3.8), but has no symmetric extension. 
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Example 14. (2 x 3). Consider states with spectral decomposition 

2 

/ B = X>I^->(^I, (4-53) 

3=0 

where the eigenvectors are |-0o) = 1 12), = 1 02) and |V>2) = y/s\00) + \/l — s\ll). 
For such a state to satisfy the spectrum condition (3.8), the eigenvalues must be 
Ao = s/2, Ai = (1 — s)/2 and A2 = 1/2. To p AB we now apply a filter operation 
in the standard basis in the A system, F = y / p|0)(0| + |1)(1|. This is a 1-SLOCC 
operation and cannot break a symmetric extension. After a successful filter, the 
global and local eigenvalues \j(p) and X B {p) are 

B r\ _ S P 



x ^(p) = T-rz> A o (p) 



l+P uwv l+p' 

w-^r^. ^>- 1 ' (1 r + s) r p) 

Except when s £ {0,1/2,1} or p G {0,1}, the spectra of the local and global 
density matrices are different. Since a filtering like this will keep a pure symmetric 
extension if the original state had one (Corollary 6, section 3.2.3), p AB cannot have 
a pure symmetric extension. For 1/2 < s < 1 and < p < 1, the state has no 
symmetric extension at all. This is because in this regime the coherent information 
1(A) B) := S{p B ) - S(p AB ), where S(-) is the von Neumann entropy, is positive. 
This is a lower bound to the distillable entanglement with one-way communication 
from A to B [DW05]. By monogamy of entanglement, p AB cannot have a symmetric 
extension. 



4.3 Rank-2 states 

In this section, we prove conjecture 8 from section 4.1 for two-qubit states of rank 
2. When p AB has rank 2, the determinant in Eq. (4.1) vanishes, and since the 
remaining inequality only compares the purity of the states, we can as well use the 
maximum eigenvalues to compare it. 

Theorem 15. A two-qubit state p AB of rank 2 has a symmetric extension if and 
only if 

\max(p AB ) < Xmax(p B ) (4.54) 

Proof. We first prove the "if" part. Assume that p AB is a two-qubit state of rank 
2 that satisfies Eq. (4.54). We can write it in the spectral decomposition 

p AB = (1 _ A )|^ )(^ | + A|ViXVi|- (4-55) 
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1 




po A pi 1 



Figure 4.2: Decomposition into pure-extendible states for two qubit states of rank 2. The 
dashed lines are global eigenvalues as parametrized on the x-axis. The solid lines are the 
local eigenvalues. The state with global eigenvalues (1 — A, A) is a convex combination 
of states with global eigenvalues (1 — po,Pa) and (pi,l — Pi), which have the same local 
eigenvalues and therefore a pure symmetric extension. 

Consider the class of states with the same eigenvectors as above, parametrized 
by p, p AB = (1 - p)\ipo) {ipo\ + p\tpi)(i/ji\. Now, p AB = p AB . For p = and 
p = 1, the corresponding pure states satisfy X max (Pp) < X mSLX (p AB ) = 1. Since at 
p = A, X meLX (p B ) > X max (p AB ) by assumption and A max is a continuous function 
of the parameter p, there must exist parameters po £ [0, A], p\ G [A, 1] such that 
AmaxOp ) = AmaxO^f) and A max (p^) = X ma . x (p AB ) (see Fig. 4.2). From theorem 
10, we know that p AB and p AB have pure symmetric extensions, \iP P0 )abb' an d 
\ip Pl )ABB'- Since p AB is a convex combination p AB = (1 — q)pp B + qp p B , where q = 
{\-po)/{pi -po), a symmetric extension of p^ B is p ABB ' = (1- q)\ip P0 ){ip P0 \ABB' + 
<i\4>pi){4>pi\abb>- 

Now, for the "only if" part, assume that p AB is a bipartite state of rank 2 that 
has a symmetric extension to two copies of the qubit B (in this part we do not use 
that A is a qubit). Then by corollary 4 it can be written as a convex combination 
of pure-extendible states 

3 

and tracing out A, 

Like in the proof of theorem 11 in section 4.2.1 we can use the fact that p AB has 
support on a 2-dimensional subspace to parametrize it using Pauli operators as in 
Eq. (4.25). Likewise we expand p B as in Eq. (4.26), so Eq. (4.56) and Eq. (4.57) 
become R = YljPj^j an d v = YljPj^j- We can proceed exactly as in the previous 
proof to arrive at Eq. (4.30) which says that Rj ■ Rk < fj ■ fk- for all j and k. 
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Since p A are pure-extendible states, they have the same eigenvalues as the 
corresponding p B and therefore \Rj\ = \ fj\. Now we can use this and Eq. (4.30) to 




= ^P^f + 2 J>iP fc /*,- • R k (4.59) 



j j<k 



< $^P?l»jf + 2 ^ZPjP^i ■ ?k (4.60) 




From \R\ < \r\ and the relations to eigenvalues Eq. (4.27) and Eq. (4.28) we can 
conclude that X mSLX (p AB ) < A max (p B ) which completes the proof. □ 



Remark 16. The assumption that system A is a qubit was only needed in the 
"if" part of the proof to conclude that states that satisfy the spectrum condition 
^ma,x(p AB ) = X max (p B ) have a symmetric extension. The rest of the proof, in 
particular the "only if" part, is independent of this assumption. Therefore, no 
N x 2 state of rank 2 that satisfies X max (p AB ) > A max (p B ) can have a symmetric 
extension. 

4.4 Symmetric subspace 

In this section, we prove conjecture 8 from section 4.1 for two-qubit states that 
have their support only on the symmetric subspace, i.e. the subspace spanned by 
the three symmetric vectors |<J? + ), |^ _ ), and | X I /+ ). We will make use of the Pauli 
operator basis to expand the density operator, 



The 4x4 matrix of the indices is called the i?-matrix of the state, and its 
elements are explicitly given by rij := tr[p AB (<Ji®<jj)], i,j G {0, 1, 2, 3}. Let us first 
see which i?-matrices correspond to states with support on the symmetric subspace. 

Lemma 17. The two-qubit Hermitian operator expanded in the local Pauli basis 




(4.62) 



i=0 




(4.63) 



has support only on the symmetric subspace if and only if 
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rji and 



(i) r ij 

(ii) r 00 = rii + r 22 + r 33 . 

Proof. Condition (i) means that M is invariant under exchange of A and B, which 
is certainly a necessary condition for being on the symmetric subspace. Condition 
(ii) comes from imposing that the state having no overlap with the 1-dimensional 
antisymmetric subspace, spanned by the single vector |*~). Expanding | ^ — } | = 
|(1 ® 1 — Ylk=l a k ® Cfc), we impose 



= 

= trH*-)(*-|] 
1 3 

— [X) r y tT K ai ® a j)( a o ® °o)] - ^5Z r ^' tr ^ cri 



Oj)(o"fc ® (Tjfc)] 



ij k=l 



1 — 3 



ij k=l 



1 3 



fc=i 



(4.64) 
(4.65) 

(4.66) 
(4.67) 
(4.68) 



which is the same as condition (ii). The other part is to show that any Hermitian 
operator with that satisfies conditions (i) and (ii) has support only on the sym- 
metric subspace. This follows since any operator that satisfies (i) is a direct sum 
of operators on the symmetric and antisymmetric subspace. Condition (ii) then 
ensures that there is no support on the 1-dimensional antisymmetric subspace. □ 

Theorem 18. A two-qubit state p AB whose support is the symmetric subspace has 
a symmetric extension if and only if Eq. (4.1) holds. It here reduces to 



tr[(p B ) 2 ] > tr[(p 



AB\2i 



(4.69) 



Note that the condition also is necessary and sufficient if the support of p is 
a proper subspace of the symmetric subspace. In that case, it is either of rank 2 
and covered by theorem 15 or it is of rank 1 and a pure product state. 



Proof. For the "only if" part, assume that p has the symmetric subspace as its 
support and has a symmetric extension. The condition (4.69) can be written as 
f(p AB ) '■= tr[(p B ) 2 ] — tr[(p j4B ) 2 ] > 0. First, we want to show that when restricted 
to states that are invariant under swap of the A and B systems (of which states on 
the symmetric subspace is a subclass), / is a concave function. 
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When we expand in the Pauli basis, the state and its reduced state are given by 

\ ^2 r iJ a i ® °h ( 4 - 70 ) 



By using that tr \<JiOj\ = 2Sij and that tr[(<7j <S> &j)(ak £3 <7/)] = 45ik5jl we get 

tr[pi B ] = ^4, (4.72) 

tr[pi] = ^X>Oi, (4-73) 

i 

tr[p|]-tr[pi B ] = ^^.-^^4. (4.74) 
i=o i=i i=o 

This is neither concave nor convex, since the first sum is of convex terms and the 
negative sign makes the second part concave. However, for states that are invariant 
when swapping A and B, ry = rji, so the three terms in the first sum corresponding 
to j 7^ are cancelled by a corresponding term in the second sum, leaving that for 
these states 

tr [pi] - tv[ P \ B ] 4k-EE r l ) • ( 4 - 75 ) 



i=l i=l 



Since roo = 1 is constant, this is a concave function. 

The state p AB has a symmetric extension, so it can be written as a convex 
combination of states with a pure symmetric extension (corollary 4), 

P AB = Y,P^ B - ( 4 -76) 

i 

Since p AB only has support on the symmetric subspace, the pure-extendible states 
must also have their support on this subspace. The pure-extendible states satisfy 
the spectrum condition X(pab) = ^(pb) (theorem 5), so f(pf B ) = for all i. Since 
/ is concave on the symmetric subspace, 

f( P AB ) = f{Ep^ B ) > Ep^p? b ) = °> ( 4 - 77 ) 

i % 

so condition (4.69) is satisfied. 

For the "if" part, assume that p has the symmetric subspace as its support 
and satisfies condition (4.69). In this part of the proof, we will show how any such 
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state can be decomposed into a convex combination of other states that we know 
have a symmetric extension. We will first split off a separable part if the inequality 
is not tight, and then deal with part where the condition is satisfied with equality 
If the inequality in Eq. (4.69) is strict, we can write f(p AB ) = tr[(p B ) 2 ] — 
ti[(p AB ) 2 ] > 0. We can then decompose the state into the maximally mixed state 
on the symmetric subspace and another state po, 

P AB =P^P + (1-P)P0, (4.78) 

where -P sym is the projector onto the symmetric subspace and P sy m/3 is a separable 
state and therefore has a symmetric extension. We may increase p gradually until 
either rank(po) < 3 or f(po) = 0. In the first case, we already know from theorem 
15 that po has a symmetric extension, since it is a rank-2 or rank-1 state with 
f(po) > 0. We therefore have that our state is a convex combination of two states 
with symmetric extension and therefore has symmetric extension itself. In the 
second case, we have decomposed our original state into a state with symmetric 
extension (P sym /3) and a state po which satisfies f(po) = 0. We therefore now 
assume that f(p AB ) = and we will show that such a state can be decomposed 
into two states with a pure symmetric extension. 

From f(p AB ) = 0, the i?-matrix of the state p AB gets another constraint in 
addition to (i) and (ii) from lemma 17. This constraint is 

i=l j=l 

Now, choose an arbitrary vector k := (^1,^2,^3) and consider the one-parameter 
family of Hermitian operators defined by 

3 

p(t) =p AB + t E k i^ 1 ® a i + a 3 ® ^ ( 4 - 80 ) 
3=1 

The value of t will only influence R-mathx elements of the form r^o and roi- The 
state will therefore remain on the symmetric subspace and still satisfy Eq. (4.79) 
and f(p(t)) = for any value of t. Since p AB has full rank on the symmetric 
subspace, p{t) will be a state for \t\ small enough. There will be a i+ > and a 
t- < such that p(t) is a state for i_ < t < t+, but it will have negative eigenvalues 
for t < t- and t > t + . Since the spectrum is a continuous function of the operator, 
the states p(t~) and /c(t+) will have maximum two nonzero eigenvalues. Since they 
also satisfy t?[p AB {t±)] = tr[p B (t ± )} and tr[p AB (t±) 2 } = ti[p B (t±) 2 ], it means that 
A(p AB (i±)) = \(p B {t±)). This is equivalent to p AB (t±) having pure symmetric 
extensions by theorem 10 (section 4.2.1). The original state is a mixture of these 
two pure-extendible states: 

p AB = j—r^p( t +) + r^r p{t - ] > (481) 
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and therefore has a symmetric extension. □ 

4.5 Bell-diagonal states 

Bell-diagonal states are most commonly defined as two-qubit states of the form 

p AB = PJ |$+)($+| +Px \q>+)(q>+\ + Py \y-)(q>-\ + Pjr |$-)(*-|. (4.82) 

Since all the maximally entangled states have maximally mixed subsystems, we also 
have p B = tr[p AB ]t/2 for Bell-diagonal states. The conjectured condition (4.1) for 
two-qubit symmetric extension can therefore be written as 

Vdet(p^) > tr[(/ B ) 2 ] - \{t?[p AB \? ■ (4-83) 

In this section, we will follow the procedure of section 3.3 for the special case of one 
qubit pair (N = 1) in order to use the symmetry of this class of states to simplify 
the problem (section 4.5.1). We will then in section 4.5.2 formulate the simplified 
problem as a semidefinite program and solve it analytically. The solution to the 
semidefinite program is not exactly Eq. (4.83), but rather the condition specified 
in Eqs. (4.111a)-(4.111c). We will find this formulation of the condition useful in 
section 8.3. In section 4.5.3 we show that the two conditions are equivalent. 

4.5.1 Using symmetry to simplify the Bell-diagonal symmetric ex- 
tension problem 

Due to the symmetry of the state (as listed in section 3.3.1) it can also be parame- 
trized as 

p AB = j( a ol <8> 1 + ol x o x <g) a x + a y a y ® a y + a z a z <g> a z ), (4.84) 

where 

ao = Pi + Px + P y + Pz (4.85a) 
OL x = Pi + Px ~ P y ~ Pz (4.85b) 
"y = -VI + Px ~ Py + Pz (4.85c) 
a z = Pi -Px-Py+Pz- (4.85d) 

When we impose the corresponding symmetries on the extended state only terms 
of the forms 1 <g) 1 ® 1, G{ ® <7j <g) 1, Ui ® 1 <g) <Tj, and 1 <g> &i ® Oi for i G {x, y, z} 
survive. No terms of the form a x ®a y ® a z and permutations appear, since we have 
only one qubit pair and these terms appear only for two and more qubit pairs. The 
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extended state therefore has to be of the form 

p ABB' _ ( ao j0 i ® i 
8 

+ ol x o x (8 a x ® 1 + a y <jy (8 a y <8 1 + a z a z (8) a z ® 1 
+ a^cr^ ® 1 <g> cj^ + c^efy <8 1 <g) cr y + <8 1 ® cr z 
+ /3 X 1 8) era, (8) cr* + (8 cr y (8 cr y + <8> a z <8 er*), (4.86) 

where the a, parameters are fixed by p AB and the three parameters are open. 
This is a 8 x 8 matrix, but we can reduce the relevant dimension to by focusing on 
the +1 eigenspace of o z (& o z (& a z and replace the terms in Eq. (4.86) according to 
table 3.1. This gives the projected extended states 

P + p ABB 'P + = 1 -(a l®l 

+ a x a x <g> <J X + Ctydy ®Uy + Ot z (T z ® G Z 

+ a x a x (g> 1 - a y a x (8 a z + a z l (8 cr z 

+ ^1(8^-^^(8^ + ^(81) (4.87) 





a + 2a 2 + j3 z 


Px~Py 


Ox Oiy 


Ox Oiy 


1 


Px~Py 


a - 2a z + p z 


a x + a y 


a x + a y 


8 


OL X Oly 


a x + a y 


ao - Pz 


Px+Py 




OL X Oly 


a x + a y 


Px+Py 


ao - P z _ 




'ao + 2«i + Pi 


V2p2 




V2a 2 ' 


1 


V2f3 2 


a - 2ai + Pi 


V2a 3 


V2a 3 


8 


V2a 2 


V2a 3 


a - Pi 


V2P 3 




V2a 2 


V2a 3 


V2P 3 


ao - Pi. 



(4.88) 



(4.89) 



where we in the last line have defined ai := a z , a 2 := (a x — a„)/\/2, and a 3 := 
(a x + a y )/V2 and similarly for Pi, p 2 , and p 3 . These parameters will be useful 
later, so we include their relation to the eigenvalues of the Bell-diagonal state, 

ao=Pi+Px+Py+Pz = l> (4.90a) 

Oil = Pi -p x ~Py +Pz, (4.90b) 

a 2 = V2( Pl - Pz ), (4.90c) 

a 3 = V2(p x -p y ). (4.90d) 

The new open variables p 2 and p 3 are independent, so we can choose p 3 = (ao — 
P z )/y/2. With that choice, the last two rows and columns are equal so we only 
need to check when we can find values for the two remaining open parameters Pi 
and p 2 such that the upper- left 3x3 matrix is positive semidefinite. If we can, the 
state defined by the on has a symmetric extension, otherwise it has no symmetric 
extension. 
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4.5.2 Using semidefinite programming to solve the simplified prob- 
lem 

To solve this simplified problem, we will use techniques from semidefinite program- 
ming (see section 2.3). As it stands, the problem is the following feasibility problem 
on the standard form (2.73a)-(2.73c), 



where 



minimize 
subject to 



C 



A, 



tr[CX] 
tr[AX) 
X > 



0' 





0' 
-1 





"o o r 



1 

"0 0' 

1 

1 

"1 0" 

1 

2 



1,...,4 



b 1 = 4ai, 
b 2 = 2v / 2a 2 , 

6 3 = 2^03, 

64 = 4a , 



(4.91) 
(4.92) 
(4.93) 



and X is the upper-left 3x3 part of P + p ABB ' P + (without the factor 1/8) and that 
is the variable to be optimized. Since C = 0, there is no optimization to be done 
if a feasible solution is found. We can get an SDP that involves optimization by 
removing the last constraint and minimizing the corresponding variable instead of 
fixing it. By taking C = diag(l, 1, 2), we minimize the trace of the density operator. 
This gives us an SDP which is similar to the original one: 



minimize tr[CX] 

subject to tr[AjX] = bi, i = 1, . . . , 3 
X > 



(4.94) 
(4.95) 
(4.96) 
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where 



C 



A, 



A, 



1 0" 
1 
2 




-1 


o o i 



1 

0' 
1 
1 



bi = 4a\, 
b 2 = 2V2a 2 , 
b 3 = 2\/2a 3 . 



A value of the objective function of 4«o corresponds to a normalized density matrix. 
If the optimum of the objective function is less than that, a multiple of C can be 
added in order to obtain a suboptimal feasible X that represents a normalized 
symmetric extension. If the optimum is greater than 4ao, a symmetric extension 
cannot exist, since the symmetric extension would give a feasible X with tr[CX] = 
4a - 

The advantage of expressing the SDP like this is that it is now always strictly 
feasible; by adding a large enough multiple of C or 1 to X it is always possible to 
make it satisfy X > 0. This gives us an advantage in that strong duality holds and 
we can use complementary slackness in analyzing the optima (see section 2.3.2). 
We express the dual of the above SDP on inequality form, 



minimize 



8=1 



subject to A{x) := C + x\A\ + x 2 A 2 + X3A3 > 



(4.97) 
(4.98) 



where Xi are the variables that are to be optimized and Ai and bi are taken from 
the primal SDP. The form of A{x) is then 



A(x) 



1 + x 2 

1 — x\ X3 
x 2 x 3 2 



=1 hx* > 



(4.99) 



-4an 1 . If a feasible 



The state has a symmetric extension if and only if 
x is found that gives an objective function below — 4ao, we know that the minimum 



1 If we had maximized — £/i=i b%Xi instead of minimizing J^| =1 biX%, the limit would have been 
the same as for the primal problem. The dual of a minimization problem is a maximization problem, 
but here the minimization is conceptually simpler, so we express the problem this way. 
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will not be greater and therefore the corresponding state cannot have a symmetric 
extension. 

The complementary slackness condition (2.83) says that for the optimal X* of 
the primal problem and the optimal x* of the dual problem, we have 



A{x*)X* = 0. 



(4.100) 



The first simplification we get from condition (4.100) is that rankL4(x*)] +rank(X*) 
< 3 since A (x*) and X* must have support on orthogonal subspaces. Since both 
A(x*) = and X* = are excluded by the constraints, at least one of F{x*) and 
Z* must have rank one. 

In order to solve the semidefinite problem, we proceed as follows. We first 
consider X of rank one. This will give us a sufficient condition for a symmetric 
extension. We then consider the case when this condition is not satisfied. Under 
the assumption that the state still has a symmetric extension, we use complementary 
slackness to show that there can only be four possible X* for any given p AB . If none 
of these candidates satisfy X > 0, we get a contradiction and the state cannot have 
a symmetric extension. It turns out that the candidates all satisfy tr[CX] < 4a0) 
though, so if one of them also is positive semidefinite, it also proves that the state 
has a symmetric extension. We end up with the conditions for symmetric extension 
listed in Eqs. (4.111a)-(4.111c). 

Start by finding the possible values for the objective function when X is rank 
one. From the constraints tr[AjX] = hi of the primal problem and filling in with 
new open parameters ti, X gets the form 



X 



'4ai + ti 
s/2a 2 



t 3 V2a 2 
V2as t 2 



(4.101) 



The objective function only depends on the diagonal of this matrix, so we want to 
determine t\ and t 2 from the rank-one condition. Since X is real and symmetric, we 
can parametrize its eigenvector with three real numbers . This gives an alternative 
characterization of X, 



X 



a i 
a\a 2 

0103 



a\a 2 aia3 



a 2 az 



a 2 a 3 



(4.102) 



and we can solve the problem by equating these. Taking the ratio of the 1,3 and 2,3 
elements, we get a\/a 2 = a 2 /a 3 when 02,03,03 7^ 0. The ratio of the 1,1 and 2,2 



elements is the square of this, which implies that ti = Aa\a\/ {a\ — Q3 
the fact that the square of the 2,3 element equals t\t 2 to find t 2 = (o^ 
The objective function is then 



Now use 
«3)/2ai. 
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and since it is fixed by the state (and the requirement that X be rank one), no 
minimization is required. If this expression is less than or equal to 4ao, the state 
has a symmetric extension. If the value is greater than 4ao, we cannot conclude 
yet since it could be that X* is of rank two and has trace less than or equal to 4«o ■ 
Thus, 

4a ai(al - a§) - (a| - a 2 3 ) 2 - 4af (a| + a§) > (4.104) 

is a sufficient but not necessary condition for the state to have a symmetric exten- 
sion. While this expression will be useful in chapter 8, it is worth noting that it 
looks nicer when converted back to the parameters defined in Eqs. (4.85a)-(4.85d), 

cy r\ 9 /\ 

2aoa x a y a z + a x a y + a x a z + a y a z < 0. (4.105) 

If Eq. (4.104) is satisfied, we know that the state has a symmetric extension, 
so from now on we assume that it is not satisfied. For a contradiction (in some 
cases), we now assume that the state has a symmetric extension. This means 
that rank(X*) = 2 and because of complementary slackness rank[A(x*)] = 1. We 
therefore want to find out for what x\, x 2 , and X3 has to satisfy for A{x) to be rank 
one. Like before, we equate A(x) as given by Eq. (4.99) to the generic rank-one 
matrix in Eq. (4.102). From the 1,2 element, it is clear that either a\ or a 2 must be 
zero. This zeroes out the first or second column and row, and we immediately obtain 
xi = ±1 and for the plus and minus cases we get X3 = and X2 = 0, respectively. 
This leaves a matrix with a nonzero 2x2 block, which must have determinant zero. 
From this we get x\ = 4 and x\ = 4 in the two cases, so x = {x\, x 2 , £3) can only 
take one of the four values (1, ±2, 0), (—1, 0, ±2). The corresponding four values of 
the objective function (4.97) are 

A ai ±AV2a 2 and - 4ai ± 4V2a 3 . (4.106) 

If any of these would be less than — 4«o, we would be able to exclude the possibility 
of a symmetric extension at this point. However, this is not possible for any states, 
since each of the four inequalities translate into pi < for one of the four eigenvalues 
Pi,Px,P y , and p z . 

The four possible candidates for x* cannot by themselves contradict our as- 
sumption of a symmetric extension for possible values of a,. However, under this 
assumption one of these candidates must be optimal. There must, therefore, be 
a complementary optimal X* of the primal problem for which the complementary 
slackness condition (4.100) is satisfied. For each of the four possible x*, we can 
impose the complementary slackness condition A{x)X = to an X of the form 
(4.101), and check if the resulting X can be positive semidefinite as required by the 
SDP conditions. For the two vectors x = (1,±2,0), this gives these values for the 
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open parameters in Eq. (4.101), 

t x = =F\/2a 2 - 4«i (4.107a) 

t 2 = T^2a 2 (4.107b) 

t 3 = T\/2a 3 (4.107c) 

which gives the two possible matrices 

(=Fa 2 =F03 a 2 \ 

zp a3 zpa 2 - 2^/201 q 3 . (4.108) 
a 2 a 3 

Since the third column is proportional to the first, the matrix is positive semidefinite 
if and only if the upper left 2x2 block is. This is positive semidefinite if and 
only if both the determinant and the two diagonal elements are nonnegative. The 
determinant is in this case proportional to a| — af db 2^/2a±a2, so the matrix is 
positive semidefinite if and only if =Fa 2 > 0, =fa 2 — 2\f2a\ > 0, and a 2 — a| =L 
2\[2a\a.2 > 0. The possible matrices for x = (— 1, 0, ±2) are 

(=Fa 3 + 2\/2ai =Fa2 «2 \ 
Ta 2 Ta 3 a 3 ■ (4.109) 

OL2 a 3 =Fa3/ 

which are the matrices we get from Eq. (4.108) by interchanging the first and second 
rows and columns and making the substitutions a 2 «-)■ a 3 , ot\ o —a\. The positivity 
conditions are =F«3 > 0, =Fa3 + 2y2a>x > 0, and a\ — a 2 =F 2\/2a\a 3 > 0. Thus, 
if the state does not satisfy condition (4.104), and also none of the four positivity 
constraints, 

a 2 - a| ± 2\/2aia 2 > and =F a 2 > and =F a 2 - 2\/2ai > 0, (4.110a) 
al - al =F 2\/2 ai a 3 > and =F a 3 > and =F a 3 + 2^01 > 0, (4.110b) 

we cannot have rankLA(x*) = 1], so our assumption that the state has a symmetric 
extension is contradicted. 

If on the other hand, one or more of the positivity constraints in Eq. (4.110a) 
and Eq. (4.110b) are satisfied, there is no contradiction and the state could have a 
symmetric extension. Actually, we can use the X which satisfies X > to prove that 
a symmetric extension exists. Computing the value of the objective function with 
X from Eq. (4.108) gives tr[CX] = — 4ai =F 4\/2a 2 < 4ao, where the inequality is 
simply the two positivity conditions pj > and p z > 0, for the plus and minus cases, 
respectively. For the X corresponding to x = (—1,0, ±2), we can show similarly 
that the objective function tr[CX] is smaller than 4«o by using p x > and p y > 0. 
The X which is positive semidefinite will therefore satisfy all the constraints (4.95) 
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Figure 4.3: The set of Bell-diagonal states that satisfies the rank-one X condition (4.111a) 
(left), rank-two X conditions (4.111b) or (4.111c) (center), and the union of the two (right). 
The figures have a maximally entangled state on each vertex and the surfaces have the 
symmetry of the tetrahedron. 

and (4.96), and since it gives a value of the objective function which is less than or 
equal to 4cto, the state must have a symmetric extension. 

Altogether, we have shown that if any of the conditions (4.104), (4.110a), or 
(4.110b) are satisfied, the state has a symmetric extension, otherwise it does not. 
Since at least one of =F a 2 > always holds, we can combine the two options in 
Eq. (4.110a) into one at the cost of adding an absolute value. We can do the same 
for =pa3 > in Eq. (4.110b) and combining everything we get that a state has 
symmetric extension if and only if one or more of the following three positivity 
conditions hold: 



The set of Bell-diagonal states with symmetric extension is pictured in Fig. 4.3. 
Condition (4.111a) describes a body that includes the symmetric extendible states 
closest to the maximally entangled states. It is, however, not convex. The conditions 
(4.111b) and (4.111c) describe four cones with vertex at the maximally mixed state 
and a maximal circular base on each face of the tetrahedron. The cones fill in the 
convex hull of the first body, so that the body of symmetric extendible states is just 
the convex hull of the body from condition (4.111a). 

4.5.3 Equivalence between SDP solution and conjecture 

Instead of having a condition which is a single inequality, the solution of the semidef- 
inite program is three positivity conditions Eqs. (4.111a)-(4.111c) where the state 
has a symmetric extension if any one of them holds. We can split the conjectured 




4ai(a| - «i) - («2 
2\f2ax\a 2 \ > 
a\ + 2\Z2ai|a 3 | > 




(4.111a) 
(4.111b) 
(4.111c) 
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condition (4.83) up in a similar way. If the RHS is not positive, the inequality is 
always satisfied, since the LHS cannot be negative. If the RHS is positive, we can 
square both sides and get rid of the square root. This gives the two inequalities 



tr[0O 2 ] - \{t?[p AB ]f < 



1 



4 2 det(/^)>{tr[(p^) 2 ]-^(tr[p^]) 2 } 2 . 



(4.112a) 
(4.112b) 



If any of the two inequalities are satisfied, the original inequality (4.83) is satisfied. 
Here, we want to prove that the set of positivity conditions Eqs. (4.111a)-(4.111c) 
is equivalent to the set of inequalities Eqs. (4.112a)-(4.112b). For the two sets of 
conditions to be equivalent, each of the conditions in one set must imply at least 
one of the conditions in the other. 

The two inequalities Eq. (4.111a) and Eq. (4.112b) are equivalent, so they there- 
fore imply each other. The equivalence can be shown by inserting pi, p x , p y , and p z 
into both inequalities, but that is a very tedious approach. We here show how to do 
it using the parameters ao, a x , a y , and a z from Eqs. (4.85a)-(4.85d). Multiplying 
both sides of Eq. (4.112b) with 4 2 gives 



det(4/ B )>{4tr[(p^) 2 ]-2(tr[p^]) 2 } : 



(4.113) 



The LHS can be computed by writing out the density matrix as a function of ao, 

a. 



I.,, a y , and a z , 



det(4p 



AB\ 



a + a 2 



a x - a. 





a — a z a x + a y 

a x + a y ao — a z 




a. 



a 






ao + a z 



a + a x + a y + a z 



a. 



2a (a x + a y 
2a x a y — 2a 2 a 2 — 2a 2 a 2 — 8aoa x a y a z 



(4.114) 



(4.115) 



For the RHS, we can use that ti[(p AB ) 2 ] = \(al+a x +a^+a 2 z ) and that tr[p AB ] = a 
to get 



{4tr[(/*) 2 ] - 2(tr[/ B ]) 2 } 2 = a* + a\ + a* + 



a. 



2a {a x + a y + a z ) 



(4.116) 



Inserting the expressions for the LHS and the RHS into Eq. (4.113), dividing by 
4, and moving everything to one side then gives Eq. (4.105) which is equivalent to 
Eq. (4.111a). 

For the other inequalities, the relations are more involved. The inequalities 
(4.111b) and (4.111c) are similar in that they describe cones from the maximally 
mixed state to each face of the state space. If any one of these inequalities are 
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satisfied, it implies that the inequality (4.112a) holds, or in more visual terms, the 
four cones defined by the inequalities (4.111b) and (4.111c) are contained inside the 
ball defined by the inequality (4.112a). If (4.112a) holds, we can only show that 
the state must have a symmetric extension, and therefore one of the inequalities 
(4.111a)-(4.111c) must hold, but which one(s) may depend on the exact state. 
The inequality (4.112a) can be converted to the parameters olq,ol\,q.2, and 03, 

a\ + a\ + a\ < al, (4.117) 

where it is evident that it describes a ball with radius q;q. For the inequalities 
(4.111b) and (4.111c), we can split up the absolute value to go back to the form 
given in Eqs. (4.110a) and (4.110b), 

a 2 — a 2 ± 2\/2a±a2 > and =F «2 > and =F«2 — 1\[2ol\ > 0, 
a 3 ~ a 2 ~F 2y/2a\a^ > and =p 03 > and =F«3 + 2^/2a\ > 0. 

For each of the four cases, we can apply an orthogonal coordinate transformation 
that takes it to a simpler form. The transformations for (4.110a) are 

a\ = ^2/3x — \/l/3y, 

«2 = tV^/Zxt VV3y- 

a 3 = z, 

The transformations for (4.110b) are obtained by interchanging ol<i with 0:3 and ot\ 
with —a\. All four positivity conditions then become simply 

x 2 + z 2 < 2y 2 and - x < V2y and x < V2y, (4.118) 

where the first inequality describes a double cone with a circular base and the 
other two cut away one part such that only the cone where y > remains. The 
purity condition (4.117) that we want to prove becomes x 2 + y 2 + z 2 < ao for all 
the four coordinate transformations. For each transformation, one of the positivity 
conditions for the eigenvalues pi translates into y < ao/v^, and since we have only 
nonnegative y we also have y 2 < «q/3. When we combine this with Eq. (4.118) 
we get x 2 + y 2 + z 2 < 3y 2 < ao, which proves that Eq. (4.112a) holds if any of 
Eq. (4.111b) and Eq. (4.111c) holds. 

The last implication we need to show is that any state that satisfies (4.112a), 
^(Pab) — V2> or equivalently (4.117), also satisfies at least one of (4.111a)- 
(4.111c). For this we use the proven fact that these inequalities are necessary and 
sufficient conditions for the state to have a symmetric extension, and therefore the 
set must be convex. Any Bell-diagonal state that satisfies inequality (4.112a) can be 
written as a convex combination of states that saturates it. One way to achieve this 
for a normalized state is to choose the four states pi := (1 — qi)\$> + )(& + \ + qipAB, 
px '■= (1 — <lx)\^ + ){'^ + \ +QXPAB, etc. with the choice of qj that gives tr[p|] = 1/2, 
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and write pab as a convex combination of these. Since the determinant of a 
state always is nonnegative, all these extremal states satisfy (4.112b), and therefore 
also (4.111a), so they must have a symmetric extension. Convex combinations of 
states with symmetric extension also have symmetric extension, so any state with 
tr(p AB ) < 1/2 has symmetric extension and therefore satisfies one of Eqs. (4.111a)— 
(4.111c). 



4.6 ZZ-invariant states 



Now, we consider states that are invariant under a z ® a z . This class includes the 
Bell-diagonal states, which are those states that in addition are invariant under 
<7 T (g) o~ T . The states invariant under o 7 ® a? are of the form 



AB 



Pi 








X 





P'2 


y 








V 


P3 





X 








Pi 



(4.119) 



in the product basis |00), |01), |10), |11). The Bell-diagonal states is the special 
case where p\ = p^ and p2 = P3- In this section, we will show that the conjectured 
condition (4.1) is necessary and sufficient in another special case of this class, namely 
when y = 0. This special class is the set of states that are invariant under S> (8) S, 
where the qubit unitary operator S := |0)(0| + i|l)(l| is often called the phase gate. 
Invariance under S'®S implies invar iance under a z a z , since S 2 = (S^) 2 = a z . 

Let us first, however, simplify the problem for the whole class of states invariant 
under o z ® a z . Without loss of generality, we can assume that pi > P2,P3,Pi 
and that x and y are both real and nonnegative, since this can be accomplished 
by changing the local basis. The following lemma gives a necessary and sufficient 
condition for a state of the form (4.119) to have a symmetric extension. 

Lemma 19. A state of the form (4.119) has symmetric extension if and only if 
there exist s € [0,p2] and t £ [0, min(p3,p4)] such that 



x < \fs\/pi - t + Vty/pi - s, 

V < V~sVP2 - t + Vty/pz - S. 



(4.120a) 
(4.120b) 



Proof For the "if" part, we give an explicit symmetric extension of the state for 
the case when the inequalities are saturated. The extended state is then the rank-2 
state Pabb' =p|V ; i)(^i| + (1 ~ p)\i>i)ktyi\ where 



\A-£#2) 



v^T^looo) + v£r=t|oii) 

+ x /i|101) + x /i|110), 
v^|001) + \/*|010> 

+ Vp3^|ioo) + v^T=7|iii) 



(4.121) 
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If a state has symmetric extension for a given x and y, then also states with smaller 
x or y have symmetric extension. This is because local unitary operators can change 
the sign of either x or y, S <g> S will change the sign of x while ® S does the same 
for y. The resulting states will also have a symmetric extension. Mixing the original 
state with one of these states will reduce either x or y of the original state, and 
convex combinations of extendible states also have a symmetric extension. Hence, 
we can have inequality instead of equality in Eq. (4.120a) and Eq. (4.120b). 

For the "only if" part, a generic symmetric operator on ABB' that reduces to 
the form (4.119) when B' is traced out has the form 



~PX - 1 
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X 


k 2 


X 


X 


t 


X 


h 


X 


X 


k 2 


X 


X 


X 


P2~t 
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k 2 


X 


X 


X 


X 


P4 - 



(4.122) 



Here, k\ + k 2 = x and h + l 2 = y. For this to be positive semidefinite, all subdeter- 
minants must be positive. From positivity of the subdeterminants 

t k 2 
k\ pi — s ' 

we get that x = k\ + k 2 < \ki\ + \k 2 \ < \fs\/pi — t + \fiy/p± — s. From the sub- 
determinants involving l\ and l 2 we get y = h + l 2 < + \ < Vi^ps — s + 
\fs\Fpi - t. □ 

Since pi > p 2 the possible values for t in (4.120a) and (4.120b) are between 
and p 2 . The parameter s, however, is bounded from above by both p% and p±. 
Before we go to the special case y = we treat the case p% > p^ separately, since 
knowing which of the two bounds applies will simplify the analysis. When p^ > p±, 
the state has a symmetric extension for any x and y, since even the rank-2 state we 
get by taking the maximum x = Jp\P± and y = ^Jp 2 pz has symmetric extension by 
theorem 15. It is also easy to verify that in this case tr[( / o- B ) 2 ] > tr[(p AB ) 2 ], so the 
condition (4.1) is always satisfied. 

We now prove conjecture 8 for the special case y = (i.e. Sr S invariant 
states). 

Theorem 20. A state p AB of the form (4.119) with y = has a symmetric exten- 
sion if and only if 



Pl-t ki 
k\ s 



and 



tr[(p B ) 2 ]>tr[(/ B ) 2 ]-4^det(p^). 



(4.123) 
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Proof. Since y = 0, Eq. (4.120b) is satisfied for any s £ [0,P3] and t £ [0,p2]- Our 
only objective is therefore to maximize the right hand side of (4.120a), 

f(s,t) := y/sVpT^t + ViVlU^s, (4.124) 

on this domain, since the maximum will be the maximum x that allows for a sym- 
metric extension. Without the constraints on s and t, f(s, t) reaches its maximum 
value of Jp\P4 for any value of (s, t) that satisfies pis+p^t = P1P4. Since s < P3 and 
t < p2 this maximum value may or may not be obtainable. The maximum value of 
P\s + pit is pips + P2Pi, so if pips + P2PA > PiPii then x = y/p\P4 can be obtained 
by choosing s = p3 and t = (pipi — P1P3) /p4 < P2- When P1P3 + P2P4 < P1P4, how- 
ever, we will have f(s,t) < JpiPi for all possible (s,t). In this case, the optimal 
choice of (s, t) is (^3,^2), since in the region where pip^ + P2P4 < P1P4, the function 
f(s,t) increases both when s and t increases. The maximum value for x is then 
\/p~3 \fP\~~P~2 + ^/P2\/P4 — P3- Summing up, a state of the form (4.119) with y = 
has a symmetric extension if and only if 

x< \ VPiPl for PiP3 + P2P4 > PlPi ^ 125 ^ 

~~ 1 VpzVpi - P2 + Vp~2 y/Pi - P3 otherwise. 

The remaining part is to show that the condition (4.123) is equivalent to this. 
The condition is equivalent to at least one of the following two inequalities holding 

tr[(/ B ) 2 ] - tr[(p B ) 2 ] < (4.126a) 
4^/det(p AB ) > I tv[(p AB ) 2 } - tr[(p B ) 2 ]|. (4.126b) 

Since y = 0, we get det(p AB ) = P2P3{piP4 - x 2 ) and tv[(p AB ) 2 ] - tr[(p B ) 2 } = 
2(x 2 — P1P3 — P2P4) ■ Inserting this into (4.126a) and (4.126b) and solving for x gives 



x < VPiPs + P2P4 (4.127a) 
x < y/plVpi ~P2 + VmVPi -P3- (4.127b) 



Only one of these inequalities have to be satisfied for a state with symmetric exten- 
sion, so the upper bound on x is the maximum of the two. By comparing the two 
bounds, we find in which region each of the two is valid, and get 

^ [ VPIP3 + P2P4 for P1P3 + P2P4 > P\P4 ,. 1O0 , 

x < < (4.128) 

[ VP3vPi - P2 + \/P2 VP4 - P3 otherwise. 

The only region where \/piPs + P2P4 is the valid upper bound is when it is greater 
than ^p\P4- Since x never can exceed -Jp\P4 for any state, this is the same as 
(4.125). □ 
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Any two-qubit state with three degenerate eigenvalues will be of this class. In 
this case, 1 00) and |11) can be taken as the Schmidt basis vectors of the nondegen- 
erate eigenvector. We can then write the state as (Ai — \)\ip)(ip\ + A/41, where Ai 
is the nondegenerate eigenvalue, A the degenerate eigenvalue, and \ip) the nonde- 
generate eigenvector. Since 1 is diagonal and only has an off-diagonal entry 

in the x position, the state is of the form (4.119) with y = 0. 



Chapter 5 



Bosonic and fermionic 
extensions 

In this thesis we use the term "symmetric extension" for extensions that are in- 
variant under exchange of two systems, without considering if its support is on the 
symmetric or antisymmetric subspace or both. An extension that resides only on 
the symmetric subspace of Hb <8> ~Hb' we call a bosonic extension, while one that 
resides on the antisymmetric subspace is a fermionic extension. Generic symmet- 
ric extensions are mixtures of bosonic and fermionic extensions. Bosonic (+) and 
fermionic (— ) extensions satisfy ir±p ABB 7Tj_ for tt± := i(l ± Pbb') the projector 
onto the symmetric/antisymmetric subspace, and Pbb'P ABB = ±p ABB ■ Here we 
show that when the subsystem to be extended is a qubit, the states with symmetric 
and bosonic extension coincides, and that this is not true in general. 

Proposition 21. // a quantum state p AB of dimension N x 2 has a symmetric 
extension to p ABB it also has a bosonic extension o~ ABB , i.e. that satisfies also 

ABB ' = \{t + P B B>)0- ABB '\{t+PBB>) (5.1) 

Proof. Decompose the extended state p ABB ' with the spectral decomposition as in 
lemma 3, 

p ABB ' = E x M^t\ + E x k\<t> k )(r k \ (5.2) 

j k 

where \4>j) = PBB'\4>j) an d = — Pbb'^u) are symmetric and antisymmet- 
ric, respectively. The vectors are of the form \<j£) = Ylk a jk\' l l ) jk) A^u) bb' where 
IV'fc )bb' are in the symmetric and antisymmetric subspace of T~Lb ® T~(-B' • When B 
and B' are qubits, the antisymmetric subspace is one-dimensional and is spanned 
by the vector l^ - ) = l/\/2(|01) — 1 10} ) . The antisymmetric vectors are therefore 
of the product form |<^7) = \tpf.) aI^ - ) bb' ■ Replacing them with symmetric vectors 
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of the form = | i) k ) a\^ + ) bb> where |*+) = l/\/2(|01) + 1 10>) yields a state 

qAbb' = £ W>( #| +^A-|C)(4 + | (5.3) 

j fc 

which has support on the symmetric subspace. Note that and A^T are no longer 
eigenvalues of this state. But since the reduced states of are the same as for 
\4>k), we have that p AB := tr B '[p ABB '] = ti B i[a ABB '], so a ABB ' is a valid bosonic 
extension of p AB . □ 

To show that this is an effect of the low dimension of the B system, we give an 
example of a state of two qutrits that has a fermionic but not a bosonic extension. 

Example 22. Consider a tripartite pure state on ABB' of the form 

|Y>) = a(|012) - |021» + 0(1120) - |102» + 7(|201) - |210» (5.4) 

where a,/3,7 7^ are all different. This is a fermionic extension of the reduced 
state p AB = tTBi[\ip)(if)\]. If p AB had a bosonic extension, a trace preserving and 
completely positive (TPCP) map on a purifying system (here B') would be able to 
convert any purification of p AB into this bosonic extension. If the TPCP map is 
given by its Kraus operators Kj which satisfy ^2jKjKj = 1b>, the output state 
when applied to \ip) would be 

a ABB> = Y^\ A ® 1 B ® Kj)\ij>)ty\{l A ®t B ® Krf. (5.5) 
j 

If a ABB ' is a bosonic extension, all the terms in this sum must be on the symmetric 
subspace. Consider one of the Kraus operators, K. Applying it to \ip) gives 

{t A ®t B ® K)\ij>) = a\Q) A \ih)BB' + P\1)a\iI>i)bb> + i\^)a\Hbb', (5.6) 

where |-0o> = |1) ® K\2) - |2) ® K\l), \ipi) = |2) ® K\0) - |0) ® K\2), and \ip 2 ) = 
|0) (8) K\l) — |1) (8) K\0). Each of the needs to be on the symmetric subspace of 
T~L b ®T-Lb'- Expressing K as J2j k kj k \j)(k\ and imposing Pbb'\4>i) = l^i) gives us 
that ^oi = ^02 = and k 2 2 = — ^11 ■ Doing the same with the other vectors we get 
that kjk = for any j 7^ k, koo = —k 22 and ku = — fcoo- The only possible solution 
to this is that K vanishes, so no nonzero K applied on B' can give a vector which is 
on the symmetric subspace. Hence, the state p AB cannot have a bosonic extension. 

This means that there are states p AB with a symmetric extension that can- 
not be extended to a pure state on four systems \iP)abb'R i n such a way that 
\i())abb'r = ^Pbb'W) abb'r- This condition means that the extension is bosonic 
(+) or fermionic (— ), but some states with symmetric extension admit neither. One 
example is if p AB does not admit a fermionic extension and a AB does not admit a 
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bosonic extension. Then the state (|0)(0|^/ ® p + ® <r )/2 cannot admit 

a bosonic nor a fermionic extensions. 

The above proposition and example prove that while for dimension N x 2, a 
symmetric extension is equivalent to a bosonic extension, the equivalence is broken 
already at dimension 3x3. This leaves the question open for dimension 2 x N. 
Preliminary tests suggest that we can convert symmetric extensions to bosonic 
extensions for dimension 2x4, but not for 2x5. We therefore conjecture that 
symmetric extensions and bosonic extensions are equivalent up to dimension 2x4, 
but not higher. 
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Chapter 6 



Degradable and antidegradable 
channels 

So far we have been interested in quantum states and whether they have a sym- 
metric extension. We make the connection to degradable [DS05] and antidegradable 
[WPG07] quantum channels which are related concepts in quantum channel theory. 
If a channel is degradable or antidegradable this greatly simplifies the evaluation of 
the quantum capacity of the channel. 

A quantum channel can be represented by a unitary operator acting jointly 
on the system and the environment — where the environment starts out in a pure 
state — followed by tracing out the environment. Given a channel N : N{p) = 
trg(£7(p g) \0}(0\e)U^), the complementary channel is the channel to the environ- 
ment, where the system is traced out, M c '(p) = trs{U(ptg> \0)(0\e)U^). The comple- 
mentary channel is only defined up to a unitary on the output system, and the chan- 
nel itself is a complementary channel of its complementary channel. A channel N is 
called degradable if there exists another channel P, that will degrade the channel to 
the complementary channel when applied on the output, J\f c = T> o J\f. Similarly, 
the channel is called antidegradable if the complementary channel is degradable, 
J\f = V o J\f c for some channel T>. 

Using the Choi-Jamiolkowski isomorphism [Cho75, Jam72], we can represent 
any channel by the bipartite quantum state resulting from the channel acting on 
one half of a maximally entangled state. We use the convention where Alice prepares 
a maximally entangled state and sends the second subsystem to Bob through the 
channel, a procedure that leaves the first subsystem maximally mixed , 

d-l 



*A more common convention is to let the channel act on the first subsystem of the operator 
M = feLo \ jj){kk\ which is a maximally entangled state, normalized such that tr^(M) = l_g. 
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Like in the rest of this thesis, we always consider symmetric extensions to two 
copies of the second subsystem, which in the Choi-Jamiolkowski representation 
represents the output system. 

Lemma 23. A channel N is antidegradable if and only if its Choi-Jamiolkowski 
representation pj^ has a symmetric extension. 

Proof. Let the channel M be antidegradable, and let T> be the channel that degrades 
the complementary channel, M = T> o J\f . Applying N on the second half of a 
maximally entangled state and applying T> to the environment produces a tripartite 
state p ABE where the reduced states satisfy p AB = p AE = pjy, but it does not need 
to be invariant under Pbe- The state (p ABE + PbeP ABE 'Pbe) nas ^ ne same 
reduced states and is also invariant under exchange of B and E. It is therefore a 
symmetric extension of pjy = p AB . 

Conversely, let the Choi-Jamiolkowski representation pj^ have a symmetric ex- 
tension p ABB . This satisfies p AB = p AB = pj^ and has a purification \^))abb'R- 
The Choi-Jamiolkowski representation of the complementary channel is then p AB R 
where B'R is the output system. Clearly, a degrading channel is then T>(p B R ) = 



This means that all necessary or sufficient conditions derived for symmetric 
extension are also necessary or sufficient conditions for the Choi-Jamiolkowski rep- 
resentation of an antidegradable channel. In particular, if conjecture 8 is true, it 
will also characterize the antidegradable qubit channels. 

By interchanging the roles of the output and the environment, we can reduce 
to problem of deciding whether a channel is degradable to deciding whether the 
Choi-Jamiolkowski representation of the complementary channel has a symmetric 
extension. A channel N with ci^-dimensional input, fig-dimensional output, and 
environment dimension of oIe is degradable if and only if pj^c of dimension d^x dE 
and rank ds has symmetric extension. Wolf and Perez-Garcia [WPG07] found that 
when dE = 2, a qubit channel is either degradable, antidegradable or both. This 
also follows from our theorem 15 about symmetric extension of rank-2 two-qubit 
states. For qubit channels with larger environment there are examples of channels 
that are neither, even close to the identity channel [SS07]. Using the following 
theorem, we can show that no qubit channels with cig > 2 can be degradable. 

Theorem 24. Any bipartite state p of rank 2 with a symmetric extension has a 
reduced state that satisfies rank(p B ) < 2. 

Proof. By corollary 4, p AB can be decomposed into pure-extendible states 



ti R (p B ' R ). 



□ 




(6.2) 



where the p A all satisfy the spectrum 
rank(p^ B ) < 2 for all j. 
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If max.,- rank(pj) = 1, all the pure-extendible states are pure product states 
p AB = <g) 4>j){i^j <S> (j>j\ by condition (3.8). Because the rank of p AB is 2, there 
can only be two independent product vectors, say \4>i <8>ipi) and \(f>2® ip2), so the 
support of p B is spanned by tpi and ip2 and therefore at most two-dimensional. 

If there is at least one j such that ra.nk(p AB ) = 2, this defines a 2-dimensional 
subspace where all other p AB must have their support. Let p AB be one of the 
p AB with rank 2. Let the spectral decomposition for it and its reduction to B be 

P? B = Tl0o><0o| + (1 - l)\<t>l)(<t>l\ and pf = 7 |0)(0| + (1 - -y)|X><l|, respectively, 
in accordance with the spectrum condition (3.8). The eigenvectors of p AB can be 
decomposed as \4>k) = |^fco)A|0)_B + |^A;i)a|1)B) where maximum one of the four 
unnormalized \^h)a can be the zero vector. Since all the other p AB have to have 
support within span{|^>i), |<fe)}) they can only ever have reduced states p B that are 
supported on span{|0), |1)}. Therefore, also p B is supported on span{|0), |1)} and 
has rank(p s ) < 2. □ 

This reduces the N x M symmetric extension problem for states of rank 2 to 
N x 2. Prom remark 16, we already have a necessary condition for this case, namely 
that \max(p B ) > ^max(p AB )- This also generalizes theorem 15 to give necessary and 
sufficient conditions for symmetric extension of a 2 x N state of rank 2. Such a state 
has symmetric extension if and only if \ ma , x (p B ) > X mSLX (p AB ) and rank(p B ) < 2. 

From the connection between symmetric extension and antidegradable channels 
in lemma 23, the following corollary automatically follows. 

Corollary 25. Any antidegradable channel N with qubit environment has output of 
rank 2. If pj^ is the Choi- Jamiolkow ski state representing the channel, \ m ax{pj\f) < 

A max (tr A [PAf])- 

Exchanging the output and the environment changes antidegradability into 
degradability: 

Corollary 26. Any degradable channel with qubit output has 6e < 2. If pj^ is the 
Choi-Jamiolkowski state representing the channel, A max (tr 'a[av]) < Xmax(PAf)- 

This result has also been independently obtained by Cubitt et al. [CRS08] by 
other methods. One could imagine that theorem 24 would generalize to higher 
rank so that the rank of the p B system always would be bounded by the rank of 
pAB £ Qr sy mm etric extendible states. This would mean that the dimension of the 
environment always would be bounded by the output rank for degradable channels. 
However, Cubitt et al. [CRS08] has proved that this only holds for channels with 
qubit and qutrit outputs. If the rank of a symmetric extendible state is R, the 
technique from the proof of theorem 24 can fail only if 1 < maxj T&nk(p AB ) < R. 
This gives the following corollary: 
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Corollary 27. If p AB has a (1,2) -symmetric extension and rank(p B ) > rank(p AB ), 
then for any decomposition into pure- extendible states 

p ab = EpipI b > 

3 

T&nk(p AB ) < r&nk(p AB ) for all j. 

Proof. Assume that maxj vank(p AB ) = rank(/9^ B ) = vank(p AB ) =: R. Let the 
spectral decomposition of p AB and its reduced state be p AB = J2k=i1k\4>k)( c l ) k\ 
and pf = Ylk=i7k\k)(k\. The eigenvectors of p AB can then be written as \4>k) = 
J2m=i iV'fcm)! 771 )- Since p AB has the full rank of p AB , the support of p AB must be 
the space spanned by the eigenvectors of p AB . This means that p B has support on 
span{{|m)}^ =1 } and therefore has rank R. Therefore, if rank(/?' B ) > R we cannot 
have maxj rank(p^ B ) = iank(p AB ). □ 



Part II 



Quantum key distribution with 
linear advantage distillation 



91 



Prologue 



The first upper bounds on the error threshold for the BB84 and six-state proto- 
cols with one-way postprocessing were based on attacks using optimal approximate 
cloning [CG97, FGG + 97, BPG99]. While perfect cloning of a quantum state is im- 
possible [WZ82], it is possible to construct a cloning machine that from one input 
state produces two or more approximate copies of the original state [BH96]. The 
threshold kicks in when Eve produces two approximate clones of the signal states 
that are of equal quality. By forwarding one of the clones to Bob, she makes sure 
that by performing the same measurement as Bob on her clone, she gets an estimate 
of Alice's signal state which is as good as Bob's estimate. 

If Alice instead of signal states sends one part of an entangled pair, such an 
approximate cloning machine will produce a tripartite state which is invariant under 
swapping the two cloned subsystems. In other words, the state that Alice and Bob 
share before measurement has a symmetric extension to the clone that Eve kept. 

In this part we use the symmetric extension concept while analyzing two-way ad- 
vantage distillation steps. When considering the alternative implementation where 
the key bits are only measured at the end of the protocol (see section 2.2.8), a sym- 
metric extension at the end of the two-way part of the postprocessing means that 
the remaining one-way part will not be able to distill a secret key. The common 
theme in chapters 8-10 is that we start with a state which is on the threshold for 
being distillable and show that after some kind of advantage distillation step, it 
still has a symmetric extension. Therefore, the considered advantage distillation 
step cannot give an improved threshold. Chapter 7 prepares the ground for this by 
defining and analyzing the classes of advantage distillation that we will analyze. 
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Chapter 7 

Linear advantage distillation 
(LAD) 

7.1 Definition 

We consider all possible advantage distillation steps based on announcements of 
parity bits from blocks of raw key. The block size is n, and from that m independent 
parity bits are announced. The blocks of bits are described as binary column vectors. 
Alice's raw data block is denoted dA and Bob's raw data block is denoted de and 
they are both of length n. The procedure then goes as follows. 

Definition 28. In linear advantage distillation (LAD) Alice announces 

a:=Hd A (7.1) 

where H is an arbitrary m x n binary matrix called a parity check matrix. Bob 
computes b := Hde and accepts if a = b and rejects otherwise. 

The entries that are 1 in row i in the parity check matrix H defines which 
bits the announced bit a, t is a parity of. Note that this procedure requires two- 
way communication since both parties need to know whether the block should be 
discarded. 

This procedure is a special case of Maurer's original proposal for advantage 
distillation [Mau93] . The original procedure involves randomly choosing a codeword 
from an error correcting code and when the code is linear, the matrix H is the parity 
check matrix of that code. The exact correspondence between the two formulations 
is shown in appendix A. In practice, the term advantage distillation has often been 
limited to the case when a repetition code is used [CF06, ABB + 06, BA07, KBR07]. 
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In this case, the parity check matrix is an (n — 1) x n matrix of the form 



H 



RCAD 



110 
1 1 

1 



(7.2) 



We call this kind of postprocessing repetition code advantage distillation (RCAD) 
and we will come back to that in chapter 8. 



7.2 Equivalent announcements 

We want to classify all the different parity check matrices that could be used in linear 
advantage distillation to potentially help distill a secret key from QKD setups with 
higher error rate than what is known to be possible with repetition code advantage 
distillation. Since Alice and Bob compute the same parity bits and only keep the 
block if they are all the same, the advantage distillation step is symmetric between 
Alice and Bob. In the following sections we only focus on Alice's announcement, 
keeping in mind that Bob effectively announces the same parity bits from his raw 
key when he announces that they should accept this block. 

Many different parity check matrices will reveal exactly the same information 
about Alice's data dA- For example announcing aj and Oj reveals the same infor- 
mation as announcing a{ and ai®aj (where © denotes addition modulo 2), since aj 
can be reconstructed from the latter when a\ is known. In general, the information 
in an announcement remains the same if two of the announced bits are swapped or 
if one announced bit is added to another (modulo 2). This means that standard 
Gauss- Jordan row operations on the parity check matrix H, gives an equivalent 
parity check matrix. 

By Gaussian elimination any parity check matrix can therefore be brought to 
the unique row-reduced echelon form, i.e. such that (i) all rows of all zeros are at 
the bottom, (ii) the first 1 on each row (called a pivot) appears strictly to the right 
of the first 1 on the row above it (if any), and (iii) the pivot is the only nonzero 
entry in its column. For example, the matrix 



M 



has row-reduced echelon form 



10 10 

10 111 

1 1 

10 1110 



(7.3) 



rrcf 



1 1 

1 1 

1 1 





(7.4) 



7.3. Equivalent announcements on permutation invariant blocks 
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Any rows of all zeros correspond to dependent announcements that may be removed. 
An announcement of m independent parity bits on a block of n bits therefore cor- 
responds to a unique parity check matrix on row-reduced echelon form without any 
zero rows. 

7.3 Equivalent announcements on permutation invari- 
ant blocks 

The blocks of n bits we will consider will come from measurements on blocks of n 
copies of a two-qubit state shared by Alice and Bob. The blocks we are interested 
in therefore has a permutation symmetry, and for announcements on these blocks, 
parity check matrices that are equal up to a permutation of the columns are equiva- 
lent. This means that the parity check matrix now is equivalent under the following 
three operations 1 

(i) add one row to another (modulo 2), 

(ii) any permutation of the rows, 

(hi) any permutations of the columns. 

By using the equivalence under permutation of columns we can move all the 
columns with pivots to the right and the others to the left, so that the parity check 
matrix takes the form 

H=[P|l m ]. (7.5) 

A parity check matrix of this type is said to be on systematic form. The matrix P 
is of size mx k where k := n — m and is called the parity matrix. The parity matrix 
is sufficient to fully specify the announcement. 

The parity matrix P is not unique, though. The most obvious symmetry is that 
its columns may be permuted in any order, since this was the symmetry that allowed 
us to collect them at the left side of H in the first place. Another straightforward 
symmetry is the equivalence under permuting the rows of P. This comes from the 
symmetry of permuting columns in the l m part of H. If columns k + i and k+ j in 
H are swapped, the resulting matrix can be brought back to the systematic form 
(7.5) by swapping rows i and j in H and therefore the rows of P also get swapped 
(see Fig. 7.1). 

The last kind of equivalence we get from the permutation symmetry of the block 
is not so trivial. This is what we get from swapping columns in P (index from 1 
to k) with columns in l m (index from k + 1 to n). Suppose entry (i, j) with j < k 

Operation (ii) is not really independent from (i), since any two rows i and j can be swapped 
by adding i to j, then j to i, and finally adding i to j again. Any permutation can then be built 
of from swaps implemented this way. Since we will use permutations of rows, it is convenient to 
have it listed as a separate operation. 
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Figure 7.1: Illustration of the equivalence operation resulting from swapping two columns 
from the 1 part (columns k + i and k+j) of a parity check matrix on systematic form [P|l]. 
On the left, the original parity check matrix H on systematic form with columns k + i 
and k + j and rows i and j highlighted. In the center, the resulting matrix after swapping 
columns k + i and k+j. Note that at this point, the matrix is not of the systematic form. 
To restore the systematic form, rows i and j are swapped, resulting in the matrix on the 
right. The end result is that the rows i and j in the parity matrix are swapped. 

in H (and P) is a 1 and we swap column j with column k + i (see Fig. 7.2). The 
right m x m part of this matrix now has a 1 on each diagonal entry and to take 
it back to the systematic form (7.5) it is sufficient to add (modulo 2) row % to all 
the other rows where column k + i (which came from column j) now has a 1. On 
P this means that row i and column j are unchanged. Also rows that have a in 
column j remain the same, while those rows that have a 1 in column j have row i 
added to them (modulo 2), in all columns but column j. Note that if column j in 
P is the only place that row i has a 1, this operation will leave P unchanged. 

The above symmetry operation that came from swapping columns j and k + i 
in H was defined when entry of P was a 1. If entry of P (and H) is 0, 
the right m x m part of H will get a row of all zeros when columns j and k + i 
are swapped, and can therefore not be brought to standard form with only row 
operations. Therefore, the swap of columns j and k + i of H will in this case not 
give rise to a symmetry operation on P. 

Any permutation of the columns of the matrix H can be achieved by a finite 
number of swaps. When H is on systematic form, the permutations of columns in 
the parity matrix part P can be generated by swaps of columns in this part and the 
same goes for the l m part. Therefore, any permutation of the rows and columns 
of P leads to an equivalent parity matrix, since they are generated by swaps of 
rows and columns. A general permutation of columns will mix the two parts. It 
will always be such that I (< min(m, k)) columns in the P part end up in the t m 
part and vice versa. A general permutation can therefore be broken down into 
three parts: first a permutation which do not mix the two parts, second swapping 
columns 1 . . . I with k+1 . . .k + l, and third another permutation which do not mix 
the two parts. The first and the third permutation correspond to permutations of 
rows and columns in the parity matrix P. The second permutation can be done by I 
consecutive swaps, each of which has to have a 1 at the right place in the left part P 
in order to avoid an all-zero row in the right m x m part of the parity check matrix 



7.4. Reducible announcements 
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Figure 7.2: Illustration of the equivalence operation resulting from swapping a column from 
the parity matrix part (column j) with a column from the 1 part (column k + i) of a parity 
check matrix on systematic form [P|l]. On the left, the original parity check matrix H on 
systematic form with row i and columns j and k + i highlighted. In the center, the resulting 
matrix after swapping columns j and k + i. Note that at this point, the matrix is not of the 
systematic form due to the additional 1 entries in column k + i. To restore the systematic 
form, row i is added to all other rows that has a 1 in column k + i, resulting in the matrix 
on the right. 



H. Therefore, the only column permutations that allow for the systematic form to 
be reconstructed from row operations are the 3 mentioned types. This means that 
any two equivalent parity matrices Pi and P2 can be taken from one to the other 
with the symmetry operations 

(i) Swap two columns 

(ii) Swap two rows 

(hi) For any entry (i, j) with a 1, keep row i and row j unchanged. Keep rows 
which has a in column j unchanged. For the rows that have a 1 in column 
j, add (modulo 2) row i to that row, except for column j. 



7.4 Reducible announcements 

The two previous sections show how different announcements of m bits on block 
size n reveal the same information about the bits in that block. When testing a 
set of announcements it is therefore sufficient to test using one parity check matrix 
from each equivalence class. Some announcement are reducible in that they are 
equivalent to one or more announcements with fewer announced bits or on smaller 
block size. 

The first kind of reduction is when the rows in the parity check matrix H are 
linearly dependent. If that is the case, the announced bits are redundant and some 
of them can be removed. On row-reduced echelon form, the parity check matrix 
then has one or more rows of all zeros, so the corresponding announced parity bit 
will always be zero. It is therefore equivalent to use a parity check matrix where 
the rows of all zeros are removed, reducing m. 
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The second kind of reduction is when a column in the parity check matrix 
consists of only zeros. This means that the corresponding bit in the raw data does 
not influence the announced data, so no information about that bit will be revealed. 
We can then as well remove that bit from the data and the zero column from the 
parity check matrix, reducing n. The example 4x6 matrix in Eq. (7.3) has both a 
zero column and linearly dependent rows, so it can be reduced to a 3 x 5 matrix by 
removing the second column and last row in Eq. (7.4). 

A third kind of reduction is when a row in the parity check matrix only has a 
single 1 and the other entries in that row are zero. In the parity matrix, this will 
show up as a row of all zeros. If row i is such a row and the 1 is in column j it means 
that the ith announced bit will be equal to the jth raw bit, so the jth bit is no 
longer secret after the announcement. In this case, we can remove the bit from both 
the announcement and the raw data in order to have an equivalent announcement. 
This means that we remove row i and column j from the parity check matrix. On 
a parity matrix, this corresponds to removing the (all zero) row i. 

The two last kinds of announcements are both examples of announcements where 
a single data bit is treated separately from the rest. In general we can have a 
subblock of bits that are treated independently from the other bits. For example, an 
announcement of m-i parity bits from a block of n\ data bits and an announcement 
of 1712 parity bits from a block of rii data bits can be interpreted as an announcement 
of mi + "^2 bits from a block of n\ + n.2 bits. The parity check matrix will then be 
a direct sum of the two parity check matrices, H = Hi © H2. If we can bring the 
a parity check matrix to this form using equivalence operations, we can reduce it 
two two independent announcements. For example, the 3x6 parity check matrix 
on systematic form 



10 110 

10 10 

1 1 



(7.6) 



can be written as 



1110 
10 10 
1 1 



(7.7) 



by moving column 2 and 5 to the right and row 2 to the bottom. We see that the 
latter form is a direct sum of a 2 x 4 and a 1 x 2 parity check matrix on systematic 
form. From the example, we see that if we have parity check matrices on systematic 
form, it is sufficient to bring the parity matrix P to the form P = Pi © P2, since 
the 1 part can always be split up and added such that the parity check matrix also 
takes the form of a direct sum. 



7.5. Quantum implementation of systematic announcements 
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7.5 Quantum implementation of systematic announce- 
ments 

In linear advantage distillation (LAD), both Alice and Bob announce parity bits 
from their data blocks and postselect on equal outcome. This section describes 
how we implement this announcement in order to keep track of how the underlying 
quantum state changes. 

The announcement is performed on a block of bits that comes from measurement 
of qubits in the computational basis. We can imagine that instead of measuring all 
qubits and then announcing parities of the obtained data, we measure those parities 
directly on the quantum state and announce them (this is justified in section 2.2.8). 
Say that one of the rows in a parity check matrix (not necessarily on systematic 
form (7.5)) is [10011], i.e. we are supposed to announce the parity of the first, fourth, 
and fifth bit. Instead of measuring a z (giving results ±1, where +1 maps to and 
— 1 maps to 1) on each of those qubits and announcing the result, we can measure 
the operator a z ® 1 (g> 1 ® a z ® a z . In practice this can be done by attaching an 
ancilla in the state |0) and performing three CNOT gates, with the ancilla as target 
and the first, fourth, and fifth qubit as source, followed by a measurement of a z on 
the ancilla. By following this procedure, we only measure the information we are 
announcing and the rest is left as quantum information that can be measured later. 
If the qubits that we start out with in the block are entangled with another block, 
we can assess the secrecy of the bits after the announcement by keeping track of 
the quantum state that is left after the measurement. 

When we cast the announcement into systematic form (7.5), the last m qubits 
only affects the outcome of one of the announced bits. Because of this we can avoid 
the use of ancilla qubits in the measurement and instead measure on the last m 
qubits. The way to do this is the following: For each 1 in the P part of H there will 
be one CNOT with one of the k first qubits as source and one of the m last qubits 
as target. If there is a 1 in entry where j < k, the corresponding CNOT will 
have qubit j as source and qubit k + i as target. After this unitary operation, parity 
bit i can be measured simply by measuring qubit k + i. After measurement and 
announcement of the m parity bits, we are left with a quantum state on k qubits. 

A quantum circuit for this operation can be constructed directly from the parity 
check matrix by going through one row at a time. If we let the time flow downwards, 
such that each line that denotes a qubit is directly below the corresponding column 
in the matrix, the diagonal of the l m part of H will show up as a series of targets 
on the corresponding qubits. On the first k qubits there will be a control dot for 
each 1 in the P part of the matrix. For example, the parity check matrix 





" 


1 


1 





" 


H = 





1 





1 







1 


1 








1 



has the corresponding quantum circuit, 
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^3 

□ 

The first two CNOTs correspond to the first two rows, while the last two CNOTs 
correspond to the last row. 

In linear advantage distillation, we always use the same circuit on Alice's part 
and Bob's part of the system. When we have two (possibly different) Bell states 
and apply a CNOT from the first to the second qubit on each side, the result is 
still two Bell states [BDSW96]. The final measurement only serves to distinguish 
whether the measured pair was in one of 2 \^) := ( 1 00) ± |ll))/\/2 or one of 
\^^) := (| 01) ± |10))/\/2- So since in our case the system before announcement and 
postselection is in a multi-qubit Bell-diagonal state (i.e. a probability distribution 
over different possible strings of Bell states, see section 3.3), it will remain so after 
afterwards. 

With the chosen implementation of the measurement of the parity bits, the 
state after measurement is unique given the starting state. We could also have 
chosen a different measurement of the same parity bits, for example by adding a 
CNOT in the end on the first two qubits in the example circuit and a few controlled 
phases between some pairs. This would correspond to a measurement with the same 
POVM as the chosen one (since the probability for each outcome is the same) but 
different Kraus operators (since the post- measurement state is different). Since the 
Kraus operators that correspond to the same POVM are all related by a unitary 
operator, the different possible post-LAD states would be related by local unitary 
operators. They are therefore all equivalent when it comes to symmetric extension 
and many other relevant properties. 



7.6 Postselection vs. communication in reverse direc- 
tion 

The advantage distillation step is symmetric upon switching the roles of Alice and 
Bob, since by accepting, Bob effectively announces that he has the same parity bits 

2 The actual outcome of each individual measurement contains no information, since for any 
multi-qubit Bell-diagonal state, a measurement on any single qubit will have a completely random 
outcome. Only the correlations between qubits in a qubit pair contain information. 
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as Alice has announced. For the purpose of breaking a symmetric extension, one 
could argue that it would have been sufficient if Bob announced this data, making 
the initial announcement in the reverse direction from the one-way communication 
that comes later during privacy amplification and error correction. If this does 
not break the symmetric extension, Alice announcing some data will not help since 
this does not change the symmetry between B and B' . If, on the other hand, 
Bob's announcement does break the symmetric extension, we could risk that Alice's 
measurement and announcement would actually reintroduce a symmetric extension. 

The main reason for letting Alice release the same information as Bob is to 
make the problem tractable. If Alice does nothing, the system would be 2 n x 2 k 
dimensional instead of 2 k x 2 k . Moreover, we would not be able to use the nice 
properties of the multi-qubit Bell-diagonal states. Also, as we will argue in the 
following, with the Bell-diagonal starting states that we have, it is unlikely that 
Alice's announcement and the following postselection does any damage. 

Initially, Alice and Bob have many copies of a Bell-diagonal state (see section 
2.2.7) 

p AB = PJ |$+)($+| + Px \q>+)(y+\ +p y |tt-)(tf-|+p jr |$-)($-|. (7.9) 
The purification of this state can be written as 



)abe = Vpi\$ + )ab\I}e + v^l* )ab\x)e 

+ Vp^\^~)ab\v)e + ^/p~z\^~)ab\z)e (7.10) 



= 100)^(^711) + ^T z \z)) + |ll)^=(vS|J) - v»» 

+ \01}^=(^\x) + ^py\y)) + |10)^=(vSk) - ^Py\y)), (7.11) 
= \00) AB \^f z ) E + \U) AB \i>y z ) E + \01) AB \^ y )E + \10)AB\ip- y ) E , (7.12) 

where \ipf z ) := \{^fpl\I) ± and \ip± y ) := -^(^/p^\x) ± ^\y)) are unnor- 

malized vectors that satisfy {ipfjipty) = i^fzl^xy) = 0- From the latter form we 
easily get the classical-classical-quantum (ccq) state [DW04, HHHO09] 

^ = |00)(00|AB|^i)(^k + |ll)(ll| J 4B|«(V'7zb 

+ |01)(01U B |^+)(V+ \ E + |10>(10UB|^>(^b (7.13) 

This state summarizes Eve's quantum knowledge about Alice and Bob's classical 
bits. Eve's states corresponding to 00 and 11 are orthogonal to the ones that 
correspond to 01 and 10, so by measuring if her state is in the subspace spanned 
by \I) and \z) or \x) and \y), she can tell whether Alice's and Bob's bits are equal 
without disturbing the ccq-state. So if Bob announces the parity of some of her 
bits, Eve will know which of Alice's corresponding bits are the same and different, 
and therefore she knows Alice's value for the corresponding parity bit. Alice's 
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announcement that she has the same parity bits is therefore of no help to Eve. 
Even if Alice announced all the parity bits — regardless of whether they were equal 
or not — this information would already be known to Eve, but would tell Bob exactly 
which parity bits were different. 

The next step is to discard the block if any of the announced bits are different. 
At this point, all the parties have classical information telling them what the error 
pattern in the announced bits are, so Alice and Bob's state is an orthogonal mixture 
of states with the different error patterns. If this state does not have a symmetric 
extension, at least one of the error patterns must correspond to a state without a 
symmetric extension. We have here focused on the case where there are no detected 
errors. While it may be possible to increase the key rate by also attempting to distill 
key from blocks with few errors in addition to those with no errors, we doubt that 
states with detected errors will be able to not have a symmetric extension whilst 
the state with no detected errors has one. The fact that both Alice and Bob reveal 
their parities and postselect on equal result is therefore very unlikely to give an 
advantage to Eve over the situation where only Bob announces the parity bits. 



Chapter 8 



Linear advantage distillation 
with one encoded bit does not 
improve threshold 

In this chapter we consider the special case of linear advantage distillation (LAD) 
with one encoded bit. For blocksize n, this means that m = n — 1 and k = 1. The 
parity check matrix H therefore has dimension (n — 1) x n and the parity matrix P 
has dimension (n-l)xl. We show that for the Bell-diagonal states outside the set 
that was shown by Chau to be distillable with this kind of advantage distillation 
[Cha02], any kind of advantage distillation with one encoded bit will result in a 
state with a symmetric extension. The current thresholds for the six-state [Bru98, 
BPG99] and BB84 [BB84] protocols will therefore not be improved with this kind of 
postprocessing. This is similar to the analysis by Acm et al. [ABB + 06, BA07] but 
since we know when a state has a symmetric extension, we do not need to construct 
an explicit attack. The approach described here has been generalized to qudit 
versions of the six-state and BB84 protocols by Ranade et al.[Ran09b, Ran09a]. 



8.1 Repetition code advantage distillation (RCAD) 

When the parity check matrix on systematic form H = [P|l] defines an error 
correcting code with only one encoded bit, the parity matrix P is a (n — 1) x 1 
matrix. We have seen in section 7.4 that if a row in the parity matrix consists of 
only zeros, it is equivalent to one where that row is removed (reducing the block 
size), so for codes where the advantage distillation cannot be reduced to smaller 
block sizes, all rows of the parity matrix must contain at least one 1. Since each 
row in P now consists of only one element, that element has to be 1. Therefore the 
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only irreducible announcement of this type with blocksize n is 



1 
1 



1 






1 








Hrcad 



(8.1) 



1 











1 



This is the parity check matrix for a repetition code and we therefore call linear 
advantage distillation with one encoded bit repetition code advantage distillation 



A 2-way procedure to distill secret key from quantum correlations in a prepare 
and measure scheme invented by Gottesman and Lo [GL03], was proven by Chau 
[Cha02] to work for Bell-diagonal states with error rates that satisfy 



No known procedure can distill a secret key if the underlying Bell-diagonal state is 
outside this set. The border of this set corresponds to a QBER (p x +p y ) of 27.64 % 
for the six-state scheme (p x = p y = p z ) and 20 % for BB84 {jp x = p z , p y = 0), which 
are therefore the best error thresholds for these protocols. 

The procedure works by first applying a number of so-called B-steps (for bit 
error detection), then P-steps (for phase error correction) and in the end a one-way 
quantum error correcting code. The B-step works on two bit pairs. On each side 
the parity of the bits is computed and compared to the other side. If the parity 
differs, there must have been an error and both pairs are discarded. If the parity is 
equal, the first pair is kept. This step requires two-way communication since both 
parties need to know if they should keep the first pair. The P-step works on three 
bit pairs. The output bit on each side is the parity of the three bits. This does 
not require any communication at all, but it simulates a phase error correction step 
where two qubits are measured to give a phase error syndrome which is sent from 
Alice to Bob for comparison. Alternatively, we can look at it as keeping the two 
extra qubits on each side in a shield system which limits Eve's knowledge about 
the key system [HHHO05]. Irrespective of how we look at it, a P-step does not 
require communication from Bob to Alice, and can therefore not break a symmetric 
extension. If states with symmetric extension are to be distilled into secret key, the 
B-steps must break the symmetric extension. 

The B-steps are the advantage distillation part of this procedure. They come 
from the bit pair iteration protocol introduced by Gander and Maurer [GM94]. 
Instead of using a large blocksize to approach the threshold, it uses many rounds. 
While each B-step only uses a blocksize 2 (with parity check matrix H = [l l]), 
we can think about N rounds as an announcement on blocksize n = 2^. If no error 
is detected, the announcement reveals the parity of any two of the 2 N data bits. 
This is the same information that is revealed by RCAD on the same block. The 



(RCAD). 



(pi ~ Pz) 2 > (pi + Pz){Px + Py)- 



(8.2) 



8.2. State after RCAD 
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bit pair iteration is more efficient than RCAD, since if an error is detected in some 
of the subblocks in an early round, only that subblock will need to be discarded, 
while with RCAD we will discard all 2^ bit pairs if an error is detected. Here, we 
do not care about how many bit pairs is needed on average to distill a key, only if it 
is possible or not. What is important is that the state after successful RCAD is the 
same as after successful bit pair iteration, so for our purposes RCAD and B-steps 
are equivalent. 

Similarly, the formulation of RCAD where Alice chooses a bit at random and 
announces the data if the bit is and the inverted data if the bit is 1, is equivalent 
to our formulation. This formulation is used by Acm and Bae [ABB + 06, BA07] and 
is based on the original formulation of advantage distillation by Maurer [Mau93]. 
In appendix A we show the equivalence in the general setting of linear advantage 
distillation. Actually, any kind of advantage distillation where we after the an- 
nouncement know that the data can only have come from two possible strings, is 
equivalent to RCAD. If the two possible n-bit strings are a\ and 02, they will in 
general differ at some m > 1 positions. In those positions where they do not differ, 
the raw data is revealed and is therefore useless for key distillation and can be re- 
moved. This leaves two possible m-bit strings which differ in all positions, which is 
exactly same situation as if RCAD is performed on those m bits. 



8.2 State after RCAD 

As shown in section 2.2.7, we can regard the quantum state between Alice and Bob 
as many copies of a Bell-diagonal state, 

p AB = Pj |$+)($+| + Px \q>+)(q>+\ + Py \y-)(y-\+ Pz \$-)($-\. (8.3) 

We can think of this as a maximally entangled state which has a probability 
Pi for having suffered a cr, error on Bob's qubit. We then perform RCAD on a 
block of n copies of this state. Bob's output qubit has a bit error (either a x or a y ) 
iff all the qubits in the block had a bit error and it has no bit error iff no qubit 
in the block had a bit error. The other bit error patterns are detected and the 
block is discarded. The output qubit has a phase error (a y or a z ) if an odd number 
of input qubits had a phase error, and no phase error if an even number of input 
qubits had a phase error. So the output qubit is error free iff an even number of 
input qubits had a a z error and the rest were error free. The probability for this to 
happen given the state of the input qubits is p^ CAD = p™ + (^p™~ 2 p 2 z + p\ + 

• • • = Yl\=o^ i,2j)Pl ■ This is every second term in the binomial expansion of 
(pi ± pz) n , and by taking the average of the ± cases we get the terms we want, 
pRCAD _ 1 + p z ) n + (pi —p z ) n )- By making similar arguments we get pf CAB 
from the terms with an odd number of a z errors, and p^ AD and p^- CAD from the 
cases where there are a x and a y errors instead of 1 and a z . This gives the following 
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eigenvalues for the state after RCAD: 

\n/2\ 



j=0 

= \((pi+p z ) n + (pi-p z ) n ) (8.4a) 

L(n-1)/2J , s 
RCAD _ / n \ n-(2i+l) 2j+l 

i=o v J 7 

= ^((pj+p*) n -(p/-^) n ) (8.4b) 

^ CAD = \ (fob + + (Pk - ft,)") (8-4c) 
pf AD = 5 (fob + Py)" " fob, " P,)") (8-4d) 

where the sum of these probabilities gives the probability for RCAD to succeed. 

To quantify how the procedure improves or deteriorates the ability of a state to 
produce a key, as defined by (8.2), we define the quantity 1 

This quantity is positive on all distillable states, negative on states where (pi — 
Pz) 2 < {pi + Pz){Px + Py) and zero on the border. By inserting the recursion 
relations (8.4a)-(8.4d) into (8.5), we see that D^ CAD = nD c . Thus, if the state 
starts out with negative Dq, it will remain negative, if it starts out being zero it 
will remain so, and if it starts out being positive it can reach an arbitrary positive 
value by choosing n large enough. We will next show that this allows the procedure 
to break the symmetric extension when Dc > and not otherwise. More precisely, 
we will show that reaching Dc > 2 is sufficient for breaking symmetric extension, 
whereas all states with Dq < have a symmetric extension. 

To show this, we describe the states by the same parameters on that we used in 
the symmetric extension calculation and defined in Eqs. (4.90a)-(4.90d). In these 
coordinates, Dc = log 2 (2a2/(ao — af)) does not depend on 03 at all. The equations 
for the surfaces of constant Dc are then 

aj + 2-2~ Dc al = a = 1 (8.6) 

(we assume normalized states in this chapter, so qo = 1). These are the equations 
for ellipses with center in the origin, constant ai-semiaxis 1 and -Dc-dependent q/ 2 - 
semiaxis 

2 (D c -i)/2_ The sur f aces 

are plotted in figure 8.1. In the figure the ellipse 



x We do not care about the rate, so we expect no relation between Dc and the key rate. It is 
possible to have arbitrarily high Do and at the same time arbitrarily low key rate. 
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Figure 8.1: Plot of the Bell-diagonal state space as a function of a\ and a<i, with 
projected out. The thin dashed lines indicates the value of Dc- The shaded region S 
corresponds to separable states (for at least some as). Region A is the set of entangled 
states for which the B-steps fail to break a symmetric extension. The border between A 
and B corresponds to Dc = 0. Regions A and B together are the entangled states with 
symmetric extension for all possible values of 0:3, while in region C all the states with 03 = 
has symmetric extension, but some states with other do not. In region D no states have 
symmetric extension. The borders between regions B and C and regions C and D both have 
the shape of ellipses. The former is described by Eq. (8.12), while the latter is described 
by Eq. (8.9). 

that extends outside the state space and separates region A and B is the surface 
where Dc = 0. Inside that ellipse are thin dashed lines indicating Dc = — 1, — 2, . . ., 
and outside are similar lines indicating Dc = 1,2,.... The two other curves relate 
to symmetric extension which we will deal with next. 

8.3 Symmetric extension for cross sections 

In section 4.5, we derived conditions (4.111a)-(4.111c) for when a state has a sym- 
metric extension, 

4ai(a| - af) - (a| - a|) 2 - 4aq(a| + af) > 0, (8.7a) 
a% - - 2\/2 ai \a 2 \ > and \a 2 \ - 2y/2ai > 0, (8.7b) 
aj -of + 2v / 2ai|a 3 | > and \a 3 \ + 2\p2a x > 0, (8.7c) 
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where the state has a symmetric extension if and only if at least one of the conditions 
are satisfied. 

Unlike the surfaces for constant Dq, the surface of the set of extendible states 
is dependent on 03. In comparing symmetric extension to the Dc surfaces we will 
be particularly interested in three cross sections through the symmetric extension 
surface. One is through the center of the tetrahedron that defines the state space, 
where 03 = {p x = p y ). The two others are the two faces of the tetrahedron where 
a 3 = ±(1 - «i)/\/2 (p y = and p x = 0). 

For the cross section where p x = p y we set 03 = in (8.7a) to get the inequality 

- a\ ^4 {ax - + o? 2 - l^j > 0. (8.8) 

This tells us that any state with 02 = (and at the same time 03 = 0, that is, 
on the ai axis) has a symmetric extension, and they also happen to be separable. 
When 02 7^ 0, we get 

4 («i-0 +«2<1 (8-9) 

which describes an ellipse with center in (ai,a2) = (1/2,0), ai-semiaxis 1/2 and 
«2-semiaxis 1. In figure 8.1 this is the solid curve separating regions C and D and 
is also shown as a red ellipse in figure 8.2. Setting 03 = in Eqs. (8.7b) and (8.7c) 
gives the two conditions 

\a 2 \ > 2V2ad (8.10a) 
\a 2 \ = and a x > 0. (8.10b) 

The first of these two lines describes the area above and below lines going from the 
origin to the point where the ellipse touches the border of the state space (shown 
in green in figure 8.2). The second only describes the the a\ axis for positive ai 
(shown in blue in figure 8.2) , which is already part of the ellipse. From this it is 
clear that in the cross section 03 = 0, only states in region D in figure 8.1 do not 
have a symmetric extension. 

For the cases p y = and p x = we insert 0:3 = ±(1 — a\)/\/2 into (8.7a) to get 




1\ 2 3 2 



2 



which simplifies to 



+ -ai-l\ >0. (8.11) 



ai ~l) +^ Q 2 = 1- (8.12) 



This describes another ellipse, with center in (1/3,0), «i-semiaxis 2/3 and a 2 - 
semiaxis ^2/3. This is the solid line separating regions B and C in figure 8.1. 
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(-1,0)\ 




Figure 8.2: The colored area shows which states have a symmetric extension at the cross 
section 013 = 0. It is the union of the three sets defined by Eqs. (8.7a)-(8.7c). The red set 
consisting of the ellipse to the right of the 012 axis and the whole a.?, — line is the defined 
by Eq. (8.8). The green set that partially overlaps with the ellipse is defined by Eq. (8.10a). 
The blue set defined by Eq. (8.10b) consists of only the positive a\ axis. 

Only the perimeter of the ellipse is a solution. This can also be seen from the 
3-dimensional plot of Eq. (8.7a) on the left in figure 4.3 where the solution set 
only touches the face of the tetrahedron along a line. Only two points inside the 
state space satisfies Eq. (8.7b) with 03 = ±(1 — ai)/y/2. This is for a± = and 
I c^2 1 = l/v2 which is where the two cones with faces up and down (in the center 
plot in figure 4.3) touches the edge of the tetrahedron. Finally, Eq. (8.7c) becomes 



This fills the ellipse from Eq. (8.12) and corresponds to the circular faces of the 
cones that faces to the sides in the center figure in figure 4.3. Like in figure 8.2, the 
solution to the three conditions (8.7a)-(8.7c) are plotted in figure 8.3 in red, green, 
and blue. The union of these (which is equal to the blue set) is the set of states 
with symmetric extension in this cross section. 

The area labeled D in the figures 8.1, 8.2, and 8.3 is the only area where there are 
no states with a symmetric extension, for any a^. This is because if a state defined 
by {pt\, a?2, 03) has a symmetric extension, so does the state defined by (qi, 02, —03) 
since the states are related by local unitary operators. Then the convex combination 




(8.13) 
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Figure 8.3: The colored area shows which states have a symmetric extension at the cross 
sections CK3 = ±(1 — ai)/y/2 which corresponds to two of the faces of the tetrahedral state 
space. It is the union of the three sets defined by Eqs. (8.7a)-(8.7c). The red set consisting 
of the perimeter of the blue ellipse is defined by Eq. (8.12). The green set consists of only 
the two points with ot\ — and 0:2 = ±l/v2- The blue set is the elliptic disc defined by 
Eq. (8.13). 

(ai,a:2,0) would also have a symmetric extension. Similarly, the areas S, A, and 
B (colored in figure 8.3) are the only areas where the corresponding state has a 
symmetric extension for any 0:3. In this area, even the states on the surface of the 
tetrahedron has a symmetric extension, and by mixing the two states on each side 
(the ± cases in 03 = ±(1 — a\)/y/2) we get a state with symmetric extension for 
any a 3 . 

8.4 Distillability vs. symmetric extension 

We are now in a position to relate Dq to symmetric extension. From figure 8.1 it 
is evident that in most of the state space, the surface Dc = 2 lies strictly outside 
the outer border for symmetric extension (i.e. it lies inside area D). Towards the 
the point (1, 0), however, all the lines for constant Dc, symmetric extension border, 
and separability border converge. This is also the state towards which the sequence 
of states converges for the most relevant starting states (e.g. all states with pi > 
0.5, p z > 0) when the blocksize in RCAD increases. Even though this is a separable 
state, in any neighborhood around it there will be states without a symmetric 
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extension. By inserting Dc = 2 in equation (8.6), the Dq = 2 border can be 
described by a 2 , = 2 — 2a\ =: f{ot\). Similarly, the outer border for symmetric 
extension from Eq. (8.9) can be expressed as = 1 - 4(«i — 1/2) 2 =: g{a\). 
Taking the difference, we get A(a|) = f{a\) — g{a\) = 2{ot\ — l) 2 > 0, so the 
Dc = 2 surface is always outside the symmetric extension surface, except for the 
point (1,0) where Dc is not defined. Thus, no states for which Dc > 2, have a 
symmetric extension. RCAD can therefore break a symmetric extension whenever 
Dc > by using a blocksize greater than 2/Dc- 

In a similar fashion one can show that the Chau-border Dc = never is outside 
the inner symmetric extension border (between regions B and C) in the interval 
a\ G [0,1], which is the region where the Chau-border is contained in the state 
space. They coincide at the points (0, 1/V2) and (1,0). Thus, any state with 
Dc < has a symmetric extension. Since RCAD cannot change the sign of Dc, no 
key can be distilled with RCAD followed by one-way postprocessing if the initial 
states satisfies Dc < 0. 

To apply the Dc = threshold to the standard six-state and BB84 scenario, 
let us assume that Alice and Bob discard the data specifying which bits come from 
which bases, meaning the error rates in the different bases are identical. For the 
six-state scheme, only one possible state is consistent with the observed error rate 
Q, namely p x = p y = p z = Q/2. This immediately yields Q mSLX = (5 — \/5)/10 ~ 
27.64% for D c = 0. 

From the BB84 measurements, only the error rates in the x and z basis can be 
observed, meaning the state is not completely determined, only that Q = Q x = Q z 
for Q x := p y + p z and Q z := p x + p y . If Q is below 1/2 the possible eigenvalues 
are (1 - 2Q,Q,0,Q) + £(1,-1,1,-1) for t G [0, Q/2]. When expressed in terms 
of (a!,a 2 ,a 3 ), this becomes (1 - 2^,^2(1 - 3Q),V2Q) + £(0,2^,-2^/2). To 
determine if Dc < for any of the possible states, we minimize 2 Dc = 2a 2 ./ (1 — a 2 ). 
This amounts to minimizing |ck2 | , since a\ is fixed by Q, and it is obvious by 
inspection that t = gives the minimum. Solving Dc = 0, we find Q max = 1/5 = 
20%. 
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Chapter 9 



Linear advantage distillation 
with two encoded bits does not 
improve threshold 

In the previous chapter we analyzed RCAD (i.e. LAD with k = 1) on bits that could 
come from any Bell-diagonal state and showed that for the set of states for which 
Dc > the states did not get rid of their symmetric extension. This showed that the 
well known QBER thresholds of 20.00% for the BB84 protocol and 27.64% for the 
six-state protocol cannot be improved without changing the advantage distillation 
step. In this chapter we analyze the next logical step — LAD with k = 2. Where 
we for k = 1 had only one irreducible parity check matrix H for each blocksize, 
we now have several inequivalent parity check matrices for the same block size. At 
the same time we reduce the scope to include only the six-state protocol and show 
that no LAD scheme with k = 2 can break the symmetric extension at or above the 
known RCAD QBER error threshold 27.64%. 

In a six-state QKD setup with an average quantum bit error rate Q in the 
three bases, one possible state that an attacker may give to Alice and Bob is many 
identical copies of the isotropic state 

p AB = (1 -3p)|$ + )($ + | +p\y + )(y + \ +p\y-){$-\ (9.1) 

with Q = 2p. In order to show that the RCAD threshold cannot be improved, we 
start with the the lowest possible QBER (i.e. the best possible state) from which 
RCAD cannot produce a secret key. We get this with p = (5 — y/E)/20 in Eq. (9.1) 
which corresponds to Q = 2p ~ 27.64%. We show that for any (n — 2) x n parity 
check matrix H used in LAD on this state, the output state has a specific form. We 
then find an explicit symmetric extension for all states of that form. 
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9.1 Form of state after LAD with k = 2 



The first step in showing that states on the threshold keep their symmetric extension 
is to show that any linear advantage distillation with k = 2 can be broken down 
into RCAD on separate blocks, possibly followed by announcing the parity of the 
resulting bits. The following lemma makes this statement more precise. 

Lemma 29. Any (n, 2) linear advantage distillation announcement is equivalent to 
one of the following procedures. 

1. Divide the block into two subblocks of n\ and n2 bits (rii > l,ni + ri2 = n). 
Perform repetition code advantage distillation on each block separately. 

2. Divide the block into three subblocks of n\, ri2, and n$ (rtj > l,n\ + ri2 + = 
n). Perform repetition code advantage distillation on each block separately. 
Then announce the parity of the three remaining bits. 

If a block contains only one bit, the repetition code advantage distillation step an- 
nounces nothing and leaves the bit untouched. 

The proof for this lemma can be found in appendix B.l. 

The breakdown into repetition code advantage distillation followed by a single 
announced bit is helpful since the former has been well studied before in the context 
of QKD [GL03, Cha02, ABB+06, BA07, MRDL09] and the latter operates only on 
three bits and is the same for all parity check matrices. We are here interested in 
whether k = 2 linear advantage distillation could break the symmetric extension 
where repetition code advantage distillation (k = 1) cannot, so from here on we 
only consider announcements of the generic type 2 in lemma 29. 

Alice and Bob start out with n copies of p AB from Eq.(9.1) with p = (5 — /20, 
the best state in terms of error rate that cannot be distilled with repetition code 
advantage distillation. They then divide the block into three subblocks of {nj}| =1 
and perform repetition code advantage distillation on each subblock. The following 
lemma gives the form of the output state of such a subblock after this step. 

Lemma 30. After performing successful repetition code advantage distillation on 
a block of n copies of the state (9.1) with p = (5 — y/5)/20, the output state is a 
Bell-diagonal state 



P = Pl \<f>+)(®+\ + p x |* + )(* + | +p y \^-}(^-\ 



(9.2) 



with 




(9.3a) 
(9.3b) 
(9.3c) 
(9.3d) 



Py 



|(1- cos 0) 
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for 9 such that cosO = A= for n = 1 (i.e. nothing is announced), cos6 = ^ for 
n = 2, and cos 6 > -7= for n > 3. 

The proof for this lemma can be found in appendix B.2. 

The next step is that Alice and Bob announce the parity of the three remaining 
bits and postselect on equal outcome. The following lemma gives the form of the 
2 x 2-qubit Bell-diagonal state after such a procedure on a general 2 x 3-qubit 
Bell-diagonal state. 

Lemma 31. Consider a 2 x 3-qubit Bell-diagonal state 

a A lBl A 2 B 2 A 3 B 3 = Y^PijmmA.B, ® \^){^\a 2 B 2 ® l/WfcUa-Bs (9-4) 
i—j 

where i,j,k E {I,x,y, z}. After successful linear advantage distillation with the 
parity check matrix 

H = [1 1 1] (9.5) 

implemented as described in section 7.5 the resulting 2x2-qubit state is characterized 
by the new eigenvalues 



Pi? = Pin + Pzzz 


(9.6a) 


P°Ix = Pixx + Pzyy 


(9.6b) 


Ply* = Plyx + Pzxy 


(9.6c) 


Pit = Plzl + Pzlz 


(9.6d) 


Pxl = Pxlx + Pyzy 


(9.6e) 


Pxx = Pxxl + Pyyz 


(9.6f) 


Pxy = Pxyl + Pyxz 


(9.6g) 


Pxz = Pxzx ~\~ Pyly 


(9.6h) 


Pyl = Pylx ~\~ Pxzy 


(9.6i) 


Pyx = Pyxl + Pxyz 


(9-6j) 


Pyy = Pyyi Pxxz 


(9.6k) 


Pyz = Pyzx ~\~ Pxly 


(9.61) 


P°zf = PzII + Plzz 


(9.6m) 


Pzx = Pzxx + Plyy 


(9.6n) 


Pzy = Pzyx + Pixy 


(9.6o) 


P°zf = PzzI + Pllz 


(9.6p) 



which are normalized such that their sum is the probability of success. 
The proof for this lemma can be found in appendix B.3. 
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In our case, the 2x3 qubit Bell-diagonal state has a special form. It consists of 
three independent Bell-diagonal states, so the probability distribution is a product 
distribution, pijk = qiVjSk- The distributions qi, rj, and are of the form given 
by Eqs. (9.3a)-(9.3d), each specified by one angle. We let the three angles be 9, 
<j), and a, respectively. After the final part of the announcement we end up with 
a 2 x 2-qubit state, specified by the three parameters 9, (ft, and a. The following 
lemma characterizes the state after the final announcement of the final parity bit. 

Lemma 32. Given three two-qubit systems, each in a state of the form of lemma 
30, hut with three different angles, 9, 4>, and a. After successful linear advantage 
distillation with the parity check matrix 

H = [1 1 1] (9.7) 

the resulting state on C 4 (g> C 4 has nonzero matrix elements 



£00,00 


= Pll.ll 


= £22,22 


= £33,33 = 


-Ul + cosflXl + cos 0)(1 + 


cos a) 


(9.8a 


POO, 11 


= £11,00 


= £22,33 


= P33,22 = 


— (1 + cosd) sin sin a 
32 




(9.8b 


£00,22 


= £11,33 


= £22,00 


= £33,11 = 


— sin 0(1 + cos <j)) sin a 




(9.8c 


£00,33 


= £11,22 


= £22,11 


= £33,00 = 


— sin 9 sin <f>{l + cos a) 
32 




(9.8d 


£01,01 


= £10,10 


= £23,23 


= £32,32 = 


^(1 + cos 0)(1- cos <£)(1 - 


cos a) 


(9.8e 


£02,02 


= £13,13 


= £20,20 


= £31,31 = 


^(1-COB0)(1 + COS^)(1- 


cos a) 


(9.8f 


£03,03 


= £12,12 


= P21,21 


= £30,30 = 


^(1-COS0)(1- COS 0)(1 + 


cos a) 


(9.8g 



before normalization. We have here labeled the basis of each four- dimensional sub- 
system in the usual way, \0)a '■= \00)a 1 a 2 ; := |01)aiA 2 > \%}a '■= |10)^iA 2 ) an d 
\3)a '■= |11}j4iA 2 > an d similarly for B. 

The proof for this lemma can be found in appendix B.4. 

9.2 Simplifying the symmetric extension problem 

We now want to simplify the symmetric extension problem for a state with nonzero 
matrix elements of the form (9.8a)-(9.8g). Our ultimate goal in this chapter is to 
find a symmetric extension for all possible values of the parameters 9, 4>, and a. 
We therefore only need a simplified condition that implies a symmetric extension, 
but not necessarily that a symmetric extension would imply that the simplified 
condition holds (as long as we can show the simplified condition to be satisfied). 
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Nevertheless, in this section we show that a state of this form has a symmetric 
extension if and only if a 4 x 4 matrix satisfying certain constraints can be made 
positive semidefinite. 

The 2 x 2-qubit state is 16- dimensional and its symmetric extension is a 3 x 2- 
qubit state which is 64-dimensional and therefore represented by a 64 x 64 matrix. 
As argued in section 3.3.2 we only need to consider one simultaneous eigenspace 

a r B' a n B' 

of af 1 (g) erj 1 &> (J z 1 and af 2 (g> 07 2 ® a z 2 because of the Bell-diagonal symmetry. 
The intersection of the positive eigenspaces (which we call the +- 1- subspace) is 
16-dimensional and is spanned by the vectors 





|000>, 




|110), 


|220), 


|330) 


|101), 


|202), 


|303) 


|011), 


|022), 


|033) 


|123), 


|231), 


|312) 


|132), 


|213), 


|321) 



The subspace is closed under swapping B and B 1 , so the symmetry constraint can 
be enforced within this subspace. The marginal constraints — that p ABB reduces 
to the correct p upon tracing out B' — involves all four subspaces, so we will now 
translate those elements that are outside this subspace into equal elements from 
this subspace. 

Each of the seven equations (9.8a)-(9.8g) defines a marginal constraint. Let us 
first look at (9.8a). This says that 

A)00,000 + P001,001 + P002,002 + ^003,003 = POO.OO 

= — (1 + cos0)(l + cos0)(l + cosa). (9.10) 

Of the four matrix elements on the left hand side, only pooo,ooo is in the ++ subspace. 
We can use symmetry operations to turn the other elements into elements on this 

A R B f 

subspace. Applying a x 2 ® erf 2 ® a x 2 will swap the elements pooi,ooi and Pno,no 
and since the state is invariant under this operation the matrix elements must be 
equal. By applying a x on the other three qubits, we get that /3oo2,oo2 = ^220,220 and 
a x on all six qubits gives /O 00 3,003 = P330.330- Therefore, p o,oo = Pooo,ooo + Piio.no + 
P220,220 + /O330,330- It makes no difference if we start with other matrix elements 
of p AB that are equal to pooj they end up with it being the sum of the same four 
matrix elements of the ++ eigenspace part of p ABB . The pattern here is that a x 
on the three qubits in the second subsystem will swap indices 0f>l and 2 -H- 3, 
o~ x on the three qubits in the first subsystem swap 0f>2 and 1 o 3, and on all 
six qubits -<->• 3 and 1 2. By doing this for all the seven marginal constraints 
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O O O O <M CO CO CO (M CN CO i — I 

O^HfMCOOOO CXI CO (M CO CO (M 

O^HCNCO^HtMCO OOO < — I (M CO ^ (M CO 
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1 022} 
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Figure 9.1: Illustration of the constraints on the ++ subspace of p ABB . Each matrix 
element that enter in a constraint is marked by a symbol corresponding to that constraint. 



(9.8a)-(9.8g), we end up with the following constraints on p ABB ' . 

1 



0000,000 + 0110,110 + 0220,220 + 0330,330 
0000,110 + 0110,000 + 0220,330 + 0330,220 
0000,220 + 0110,330 + 0220,000 + 0330,110 
0000,330 + 0110,220 + 0220,110 + 0330,000 
0011,011 + 0101,101 + 0231,231 + 0321,321 
0022,022 + 0132,132 + 0202,202 + 0312,312 
0033,033 + 0123,123 + /5213,21s + 0303,303 



32 
1 

32 
1 

32 

1 

32 
1 

32 
1 

32 
1 

32 



(l + cos6>)(l + cos^>)(l + cosa) (0) 

(1 + cos#) sin sin a ( ( v ) ) 
sin 0(1 + cos 4>) sin a 

sin 6 sin 0(1 + cos a) (#) 

(1 + cos#)(l — cos0)(l — cosa) (A) 

(1 — cos0)(l + cos0)(l - cosa) (v) 

(1 - cos 6>)(1 - cos 4>){l + cosa) (□) 



In addition, some sums are constrained to be zero (those corresponding to the 
elements of p AB )- The labels are symbols from the matrix in figure 9.1, where 
each element from the ++ subspace of p ABB that enter in a marginal constraint 
is marked with a symbol identifying the constraint. We also need the matrix to be 
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invariant under swapping systems B and B' . This corresponds to swapping rows 
and columns 2-4 with 5-7 and swapping 11-13 with 14-16. 

The circular symbols in figure 9.1 (i.e. the off-diagonal symbols in rows/columns 
5-16) are for constraints where the sum of the matrix elements are zero. If a positive 
semidefinite matrix that satisfies all the constraints can be found, also the matrix 
where all these elements and all the off-diagonal elements in columns 8-16 (together 
with their transpose) are set to zero will be positive and fulfill all constraints. We 
therefore only need to look for a matrix where rows and columns 8-16 has nonzero 
elements only on the diagonal 1 . 

If such a matrix can be found, also the matrix we get by setting the diagonal 
elements in columns 11-16 to zero will be positive semidefinite. It will also satisfy 
the swap symmetry, but we have to add the removed elements to the diagonal 
elements in columns 8-10 (which are not constrained by swap symmetry) in order 
to fulfill the constraints A, V, and □ (remember that the swap symmetry demands 
that the diagonal elements 11-13 are equal to the diagonal elements 14-16, which 
is of course fulfilled when all are set to zero). We can therefore limit the search to 
symmetric matrices where columns 11-16 are zero and columns 8-10 are nonzero 
only on the diagonal. 

Now, the diagonal constraints represented by A, V, and □ are only that the 
sum of two elements should have a given value. Since the positivity of the matrix 
is unaffected as long as the diagonal elements 8-10 are nonnegative, the constraints 
translate into an upper bounds on the diagonal elements 5-7. With these upper 
bounds, only the upper left 7x7 part of the matrix is relevant. 

Because of the swap symmetry, the two remaining 3x3 blocks on the diagonal 
(2-4 and 5-7) have to be equal. With the swap symmetry constraint, the upper left 
4x4 matrix can be represented as 



" 










(OA) 


* 






* 


(❖v) 




* 


* 


9 


«>□) . 



(9.11) 



The parenthesis on the diagonal means that these elements are subject to two 
constraints, one being the sum of all four diagonal elements and in addition each of 
the individual elements except (1, 1) has an upper bound. We can now write out 



1 The S' ® S ® S symmetry discussed in section 3.3.3 can also be used to argue that some of 
these elements can be set to zero, but this symmetry argument is not sufficient for all the elements. 
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the constraints on this subspace spanned by 1 000) , 1 110) , 1 220) , and 1 330) . 

P000,000 + PllO,HO + /0220.220 + /?330,330 = ^(1 + COs6»)(l + COS(/>)(l + COS Ol) (<» 

P000,110 + PllO.OOO + P220,330 + P330,220 = ^ (1 + COS 0) sill (j) sill OL (9) 

/5ooo,220 + Piio,330 + P220,ooo + P330,no = ^ sin 9(1 + cos (j)) sin a (4) 

/Oooo,330 + Piio,220 + P220,no + P330,ooo = ^ sin 6 sin <p(l + cos a) (4) 

Piio.no < ^(1 + cos 60(1 - cos^)(l - COS Oi) (a') 

P220.220 < ^(1 - COs6 l )(l + COS0)(1 - COS Ol) (V') 

£330,330 < ^(l-cos6 , )(l-cos^)(l + cosa) (□') 

If these constraints can be satisfied by a positive semidefinite real symmetric 4x4 
matrix 



M 4 



B 


a b c 


a 




b 


M 3 


c 





(9.12) 



a positive semidefinite matrix on the 7-dimensional subspace spanned by 1 000) , 
|110), |220), |330), |101), |202), and |303) is 



M, 



B 


a b c 


a b c 


a 






b 


M 3 


M 3 


c 






a 






b 


M 3 


M 3 


c 







(9.13) 



This satisfies both the marginal constraints and the swap symmetry constraint. 
From this we can go back and reconstruct the 16 x 16 matrix by padding with zeros, 
except for the diagonal elements 8-10, which may have to be positive to fulfill the 
constraints. From this matrix, we can again reconstruct the full 64-dimensional 
(unnormalized) density matrix p ABB . Therefore, a symmetric extension exists if 
and only if a real symmetric 4x4 matrix with the constraints given by (9.11) and 
<)-□' can be found. 



9.3 Finding an explicit symmetric extension 



We now go on to show that for any output state after linear advantage distillation 
with k = 2, we can find a positive semidefinite 4x4 matrix M4 that satisfies the 
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constraints, and therefore the state has a symmetric extension. We present two 
different forms of this matrix, which work in different regimes. The first one that 
turns out to work whenever the blocksize is n > 5 is 





" B 


a 


b 


c 


1 


a 


X 








32 


b 





y 







c 








z 



(9.14) 



where the constraints define the values of the parameters. The only additional 
choice we make is that the constraints (a')-(D') be saturated. The parameters then 
have to be 



B = (l + cos0)(l + cos0)(l + cosa) 

— (1 — cos#)(l + cos</>)(l — cos a) 

— (1 — cos 9) (I — cos 4>)(1 + cos a) 





— (1 + cos 9)(1 — cos 4>){1 — cos a), 


(9.15) 


a = 


-(1 + cos#) sin^sina, 


(9.16) 


b = 


— sin 9(1 + cos (p) sin a, 


(9.17) 


c = 


— sin 9 sin 0(1 + cos a), 


(9.18) 


X = 


(1 + cos 9)(1 — cos cj))(l — cos a), 


(9.19) 


y = 


(1 — cos 9)(1 + cos — cos a), 


(9.20) 


z = 


(1 — cos 9)(1 — cos 4>){1 + cos a). 


(9.21) 



Since x, y, and z always are positive, the matrix is positive definite whenever its 
determinant is positive. The determinant of this matrix (without ^) is 



det(32M^ 1) ) = Bxyz - a 2 yz 



b 2 xz 



c 2 xy 



(1 + cos 9)(1 + cos c/>)(l + cos a 

x (1 - cos(9) 2 (l -cos</>) 2 (l 
1 



— cost/ J [i- — cos <p ) (^l — cos ex y 
(1 + cos 9)(1 + cos 4>)(1 + cos a] 

— (1 — cos 9)(1 + cos 0)(1 — cos a) 

— (1 — cos 9)(1 — cos 0)(1 + cos a) 

— (1 + cos 9)(1 — cos 4>)(\ — cos a) 



(9.22) 
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So the matrix is positive definite whenever 



/(cos 9, cos 4>, cos a) := -(1 + cos 9){1 + cos 0)(1 + cos a) 

— (1 — cos 6)(1 + cos </>)(l — cos a) 

— (1 — cos 6){1 — cos 4>){1 + cos a) 

— (1 + cos0)(l - cos0)(l - cos a) > 0. (9.23) 



On blocksize 5 there are two possible announcements of type 2 from lemma 29. 
The five qubits can be split into three subblocks like (2,2,1) or (3,1,1). In the first 
case, two of the angles satisfy cos 6 = ^ and one cos 9 = (see lemma 30). In that 

case, the function in Eq. (9.23) evaluates to f(^f, = (140- 44^/5) /36V5 > 

0. For the case (3,1,1), /(r^gi t^i ;4g) = 78 — 30\/5 > 0. Any announcements on 
larger blocks can be represented by increasing the size of one or more subblocks from 
these announcements. Lemma 30 states that this will lead to larger cos 9, cos0, or 
cos a. If / is monotonically increasing in each of its inputs, then the matrix of this 
form is positive for any higher blocksize. We can compute the partial derivative of 

df 1 

^ = -(1 + y)(l + z) + (1 + y)(l - z) + 2(1 - y)z (9.24) 



and this is positive since y, z £ (0, 1). Since / is invariant under any permutation 
of its inputs, the same holds for the other inputs. Therefore, for any output state 
after linear advantage distillation with k = 2 and blocks of size 5 or larger, we can 
construct a symmetric extension from a matrix of the form (9.14). 

The only remaining cases to cover now are blocksize 3 and 4. For blocksize 3, 
the parity of the three bits are announced directly, and for blocksize 4, two of the 
bits first go through a round of repetition code advantage distillation. For these 
cases, the form (9.14) is not positive semidefinite. But we can use the fact that in 
both cases two of the subblocks are of size 1 . Let this correspond to the two angles 
<p and a which now satisfy cos<p = cos a = 4g. We can now use a matrix of the 
form 





" B 


a 


b 


b 


1 


a 


X 








32 


b 





y 


y 




_ b 





y 


y 



(9.25) 
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where the parameters are 

B -- 



[>/5(l + cos0) - 2(1 - cos0)], 
(-1 + 3 cos 6>), 



b = -(y/E + l)sin0, 



x = -(3- \/5)(l + cos6>), 



1-COS0). 



(9.26) 
(9.27) 
(9.28) 
(9.29) 
(9.30) 



Since the third and fourth row and column are equal, we only need to check posi- 
tivity of the matrix 



M 



(2) 



1 

32 



B 


a 


b ' 


a 


X 





b 





y . 



(9.31) 



Again, the matrix is positive definite if and only if its determinant is positive. We 
get 



det(32M^ 1} ) = Bxy - a 2 y - b 2 x 



32 

= p-(l-cos0)[(\/5-4)cos 2 6l + (6\/5-8)cos0 + (5\/5-12)] (9.32) 



This is positive for 



3^/5-4-2^2^/5-3 

cost* > -= pa 0.16 

4- V5 



(9.33) 



which is more than good enough, since we always have cos# > ~ 0.45. Hence, 
we can construct a symmetric extension also in the case of blocksize 3 and 4. 
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Chapter 10 

Numerical results for 3 and 4 
encoded bits 



In this chapter we report on numerical results indicating that using a linear code 
with few encoded bits and moderate block size instead of the repetition code nor- 
mally used in advantage distillation will not increase the tolerable error rate in the 
six-state protocol. More precisely, we start with a block of n qubit pairs in the 
isotropic state 



where p depends on n and is chosen such that it gives a useful comparison to 
repetition code advantage distillation on the same blocksize. For given n and m 
we go through all inequivalent parity check matrices of size m x n and compute 
the 2/c-qubit state (k = n — m) after using each parity check matrix for advantage 
distillation. For the resulting state, we use a numerical SDP solver to verify that it 
has a symmetric extension. 

The starting state — as parametrized by p — is chosen to be less noisy than in 
the analytical calculations in the previous chapter. In that case we chose the best 
possible isotropic state such that repetition code advantage distillation could not 
break the symmetric extension for any blocksize. Then we showed analytically that 
no linear advantage distillation with k = 2 could break the symmetric extension for 
this state, again for any blocksize. In this case we are dealing with a finite blocksize 
n. It would be of very limited value to have a result that said that given a state 
for which RCAD can almost break the symmetric extension in the limit of infinite 
block size, no parity check matrix on a small block is able to break the symmetric 
extension. We therefore choose the starting state such that RCAD almost breaks 
symmetric extension on blocksize n. More precisely we choose the minimum p such 
that if we perform RCAD on n copies of p in Eq. (10.1) the resulting state has a 
symmetric extension. This means that the state after RCAD on blocksize n is on 
the surface of the set of states with a symmetric extension. The results show that 
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after linear advantage distillation with all other parity check matrices on n copies 
of that starting state, the resulting state is in the interior of the set of states with a 
symmetric extension. We therefore conclude that for the tested blocksizes, no other 
linear advantage distillation is as good as RCAD. 

Since we are dealing with numerical calculations, they are limited by numerical 
precision and also run-time and memory limitations. As the blocksize increases, the 
distance between states after advantage distillation gets smaller and approaches the 
numerical precision, while the number of inequivalent parity check matrices and the 
run-time required to compute the state after advantage distillation increases. We 
therefore only do computations up to blocksize 9. 

We use the equivalence relations from section 7.3 to skip many parity check 
matrices that are equivalent to one we already checked. However, we do not take 
care to only check one single matrix from each equivalence class, since the overhead 
of checking a few equivalent matrices is not big compared to the extra work of 
implementing thorough equivalence checking. 

The resulting state after advantage distillation is computed using the implemen- 
tation from section 7.5. After each BXOR (bilateral exclusive OR, i.e. CNOT on 
each side) the state remains in a 2ra-qubit Bell-diagonal state and also after measur- 
ing out some qubits and postselecting on equal outcomes on Bob's side, the state 
remains Bell-diagonal [BDSW96]. 

For the isotropic starting state that we consider, another symmetry is useful. 
The starting state satisfies p = {S ] ® S) p(S ] ® S) ] for S := |0)(0| +i|l)(l| the phase 
gate, which rotates the Bloch sphere an angle tt/2 around the z axis. The effect of 
this operation on a Bell-diagonal state is to swap the eigenvalues corresponding to 
|^+) and |^ _ ). We have that both 5® 1 and ® 1 commute with CNOT (where 
the first qubit is the source and the second is the target). So if we start with two 
qubit-pairs in a state that satisfies 

^AiAaBiBa = ^ ® 1 ® S ® l) p ^A 2 B 1 B 2 (^ ® 1 ® S ® l) f (10.2) 

then the state after applying a CNOT from the first to the second subsystem on 
each side 

(J AiA 2 B 1 B 2 = 

(CNOT Al ^4 2 ® CNOT Bl ^B 2 )p AlMBlB2 (CNOT M _+ M ® CNOT^^t (10.3) 
also satisfies 

a A 1 A 2 B 1 B 2 = ( 5 t <g) i g, s ® t)a MMBlB2 {S ] ® 1 ® 5 ® l) f . (10.4) 

In the implementation of the linear advantage distillation from section 7.5, the qubit 
pairs that will remain after measurement are only used as source in the CNOTs, so 
they keep the (£' ® S^-symmetry, even after the BXOR part. The only remaining 
part of LAD is the measurement and postselection based on the measurement result. 
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This can be seen as a non-trace-preserving, completely positive map on the qubits 
that are measured, and since the symmetry operation only acts on the qubits that 
are not measured, the two operations also commute, and the final state after LAD 
is symmetric under Sr ® S on any of the remaining qubit pairs. 

Having established the form of the state after LAD, we want to solve the sym- 
metric extension problem for each state. Since the state is a 2/c-qubit Bell-diagonal 
state with the additional <%> S symmetry, the symmetric extension problem can 
be simplified using the techniques in section 3.3 and implemented as an SDP as 
described in section 3.4. The SDP is then solved using Yalmip [L6f04] on Matlab 
with the SDPT3 solver [TTT99]. 

In the tables that follow are the results of the SDP calculations for k = 3 which 
means that the parity matrix P is a (n — 3) x 3 matrix. The first seven columns of 
the tables specify how many of the n — 3 rows that are equal to each of the seven 
possible nonzero 3-bit strings (remember that the order of the rows in the parity 
matrix is irrelevant). For example, row 4 in table 10.3 represents a parity matrix P 
where one row is [l 0] and two rows are [0 1 l] . So the parity check matrix 
is 



H = [P|l] 



10 10 
110 10 
110 1 



(10.5) 



which is actually a reducible announcement (see section 7.4), since it acts indepen- 
dently on two subblocks of two and four bits. We find it useful to include reducible 
announcements in the table for comparison with the irreducible announcements. 

The 8th row is the value of the parameter that is minimized in the semidefinite 
program. It can be interpreted as being the minimum t such that tt ABB /2 3N + 
pABB j g p OS itive semidefinite or equivalently such that the state tt AB /2 2N + p AB 
(normalized to trace 1 + t) has a symmetric extension. A negative value means that 
the state is in the interior of the set of states with symmetric extension, a positive 
value means that the state does not have a symmetric extension, and a value of zero 
means that the state is on the surface of the set of extendible states (see section 3.4 
for more details). The results are ordered with an increasing t as we go down the 
table. 





Table 10.1: 


Results for k = 3 and n = 


4 


100 


010 001 


111 110 101 011 


t 






1 


-0.1452 






1 


-0.0537 


1 






-0.0455 
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Tabic 10.2: Results for k = 3 and n = 5 



100 010 001 111 110 101 Oil t 







1 


1 


-0.0728 


1 






1 


-0.0655 








2 


-0.0584 


1 




1 




-0.0233 


1 


1 






-0.0205 


2 








-0.0183 




Table 10.3: Results for k = 3 and n 


= 6 


100 


010 


001 111 110 101 


011 


t 






1 1 


1 


-0.0821 


1 




1 1 




-0.0577 


1 




1 


1 


-0.0298 


1 






2 


-0.0283 


1 




2 




-0.0258 


2 






1 


-0.0254 


2 




1 




-0.0221 


1 


1 


1 




-0.0100 


1 


1 


1 




-0.0093 


2 


1 






-0.0083 


3 








-0.0071 




Table 10.4: Some results for k = 


3 and 


n = 7 


100 


010 


001 111 110 101 


011 


t 






111 


1 


-0.0659 


1 




1 1 


1 


-0.0329 


1 


1 


1 1 




-0.0275 


1 


1 


2 




-0.0252 


2 




1 1 




-0.0213 


1 


1 


1 1 




-0.0043 


2 


1 


1 




-0.0040 


2 


1 


1 




-0.0038 


3 




1 




-0.0036 


2 


2 






-0.0034 


3 


1 






-0.0032 


4 








-0.0026 
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Tabic 10.5: Some results for k = 3 and n = 8 



100 010 001 111 110 101 Oil t 



1 


1111 


-0.0245 


1 1 


1 1 


1 


-0.0136 


1 1 


1 ] 


L 1 


-0.0136 


1 1 


1 2 




-0.0132 


1 1 


1 2 




-0.0131 


1 1 


1 1 1 


-0.0128 


2 


1 ] 


L 1 


-0.0124 


2 2 


1 




-0.0016 


3 1 


1 




-0.0015 


4 


1 




-0.0014 


3 2 






-0.0013 


4 1 






-0.0012 


5 






-0.0009 


Table 10.6: Some results for k 


= 3 and 


n = 9 


100 010 


001 111 110 101 on 


t 


1 1 


2 1 


1 


-0.01245 


1 1 


1 1 1 


1 


-0.01059 


1 1 


1 1 1 


1 


-0.00997 


2 


1 1 1 


1 


-0.00892 


2 1 


2 1 




-0.00869 


1 1 


1111 




-0.00542 


4 1 


1 




-0.00057 


5 


1 




-0.00053 


3 3 






-0.00052 


4 2 






-0.00051 


5 1 






-0.00048 


6 






-0.00033 



For k = 4, we only test blocksizes n = 5 and n = 6. In the former case there 
is only one irreducible announcement, namely the one that announces the parity 
of all bits on each side. Three other parity matrices are included for comparison. 
In the latter case there are three equivalence classes that take into account the 
whole block (those that do not have a columns of only zeros) and do not reduce to 
two announcements on separate blocks (those that have at least one column of two 
ones). Five other parity matrices are included for comparison in that case. In the 
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tables, the parity matrix and the minimum value of t is listed. 

Table 10.7: Results for k = 4 and n = 5 



Parity matrix t 





1 


1 


1 


1 


-0.0924 




1 


1 





= 


-0.0847 




1 


1 


1 


0* 


-0.0301 




1 








= 


-0.0256 



Table 10.8: Results for k = 4 and n = 6 



Parity matrix t 



1 


1 


1 


1 








1 


1 


1 











1 


1 


1 


1 


1 














1 


1 





1 











1 


1 











1 


1 


1 


1 


1 


1 





1 














1 


1 


1 


1 














1 








1 











1 












-0.0430 
-0.0399 
-0.0373 
-0.0351 
-0.0151 
-0.0135 
-0.0115 
-0.0103 



The fact that t < for all these parity matrices shows that on the tested 
blocksizes, RCAD is strictly better at breaking symmetric extension than any other 
LAD scheme. We can also make some further observations from the tables. 

• The worst and best parity matrix both get a value of t closer to zero when 
the blocksize increases. Remember that that in this calculation, the starting 
state gets more and more noisy for increasing block size, so this is not merely 
due to larger blocksize detecting more errors. 

• The worst equivalence class is usually the one which contains a parity matrix 
where all the rows are different (exception for n = 9). 

• Some of the parity matrices are reducible to RCAD on separate subblocks 
(those where all rows are of Hamming weight one) and we therefore know 
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from previous results that they cannot break the symmetric extension. We 
include those for comparison. 

• The best parity matrix is the one that reduces to RCAD on a subset of the 
bit pairs that is as large as possible and the rest are ignored (i.e. RCAD with 
blocksize 1). 

• The parity matrices that reduce to RCAD on k distinct blocks are among the 
best ones. 

• The best parity matrix that does not reduce to RCAD on distinct blocks has 
one single row of only ones and otherwise RCAD on distinct blocks (usually 
on a single block) . 

The pattern seems to be that the more similar a linear advantage distillation 
scheme is to repetition code advantage distillation, the closer it is to breaking the 
symmetric extension. 
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Concluding remarks 



The main contributions of this thesis can be divided into two areas, corresponding 
to part I and part II. The first part is concerned with the classification of bipartite 
quantum states related to the concept of a symmetric extension. This part is 
independent of any applications. In the second part, the six-state quantum key 
distribution protocol — and to some extent the BB84 protocol — is analyzed using 
symmetric extension as a tool to show that certain classes of two-way postprocessing 
cannot possibly result in a secret key beyond a certain noise threshold. 

In chapter 3 of part I we started by deriving some basic properties of states with 
a symmetric extension. One key property is, from corollary 4, that any state with a 
symmetric extension can be written as a convex combination of states with a pure 
symmetric extension. We then showed in theorem 5 that for any state with a pure 
symmetric extension, its spectrum is equal to the spectrum of the reduced density 
operator on the B system. In the rest of this chapter we considered a special class of 
states called multi-qubit Bell-diagonal states. For this class of states, the symmetry 
simplifies the symmetric extension problem considerably. 

In chapter 4, we specialized to look at systems consisting of two qubits. Ev- 
erything in this chapter revolves around conjecture 8, a conjectured formula to 
characterize two-qubit states with a symmetric extension. The characterization of 
pure-extendible states simplify for two qubits, so that in this case a state has a pure 
symmetric extension if and only if its local and global spectrum is equal (theorem 
10). We also presented examples that show that this only happens for two qubits 
and not for any other dimension. Then follows a series of proofs of conjecture 8 for 
various classes of states. 

Chapters 5 and 6 deal with concepts related to symmetric extension. In chapter 
5 the relation to the more specialized concepts of bosonic extension and fermionic 
extension was analyzed. In particular, symmetric extension and bosonic exten- 
sion is equivalent for systems of dimension N x 2. In chapter 6 we converted our 
results about states with a symmetric extension to results about degradable and 
antidegradable channels. The main result here was corollary 26 which states that 
a degradable channel with qubit output has an environment dimension less than or 
equal to 2. 

With chapter 7 we enter part II which is the QKD part of this thesis. This 
chapter defined the class of two-way postprocessing called linear advantage distil- 
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lation as advantage distillation schemes based on a linear error correcting code and 
we used the parity check matrix to specify a particular scheme. We characterized 
which parity check matrices are equivalent and some ways that a parity check ma- 
trix could be reduced to simpler parity check matrices. The final section specified 
how a parity check matrix on systematic form is implemented on quantum bits 
when the measurement of the final key bits are deferred to the end of the protocol. 

The final three chapters have a common structure. They all started with the 
best possible states for which we do not know how to distill a secret key. Then 
the form of the state after advantage distillation was computed. Finally it was 
shown that such a state has a symmetric extension. This means that the advantage 
distillation step has failed to produce a state without a symmetric extension, making 
it impossible for the remaining one-way processing to distill a secret key. 

In chapter 8 we started by showing that all advantage distillation schemes which 
announce so much information that only two strings remain as compatible raw 
strings, are all equivalent, and we call this repetition code advantage distillation 
(RCAD). We here defined the quantity Dc such that the states that we do not 
know how to distill are characterized by Dq < 0. We then showed that RCAD on 
a block of states with Dq < cannot produce a state with Dq > 0. Finally, we 
showed that those states with Dc < all have a symmetric extension. 

The next logical step after analyzing RCAD, which uses a linear error correcting 
code with one encoded bit, was to check linear advantage distillation with two 
encoded bits, which we did in chapter 9. While key distillation from any Bell- 
diagonal starting state was considered in chapter 8, we specialized to isotropic 
starting states in chapter 9. This means that the results here are not directly 
applicable to the BB84 protocol or the six-state protocol where we record the QBER 
of each basis, only the six-state protocol where we record the average QBER. The 
chapter starts by identifying the form of the state after advantage distillation. Even 
though there are many parity check matrices to consider, they have enough common 
structure that the resulting state can be parametrized using three angles (lemma 
32). Then the symmetric extension problem was simplified for this class of states 
to only use a matrix of dimension 4x4. Finally, an explicit 4x4 matrix was 
constructed. From this matrix a full symmetric extension could be reconstructed. 

After concluding that linear advantage distillation with two encoded bits cannot 
break a symmetric extension beyond the current threshold, the next steps were 3 
and 4 encoded bits, which we considered in chapter 10. We started with an isotropic 
state like in chapter 9, but in this case the different parity check matrices do not 
have enough common structure to allow us to parametrize the state after advan- 
tage distillation. Instead, we let a computer run through all possible inequivalent 
parity check matrices for modest blocksizes. For each parity check matrix the state 
after advantage distillation was computed and checked numerically for a symmetric 
extension. The results showed that even though RCAD on the considered blocksize 
would be able to break a symmetric extension, none of the other parity check ma- 
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trices could do that. This indicates that of all the possible parity check matrices 
one may use, RCAD is the best option for advantage distillation, so other parity 
check matrices will not improve the known threshold. 

The main conclusion that can be drawn from part II is that the natural gener- 
alization of the currently most successful advantage distillation technique does not 
improve the QBER threshold. The results cannot exclude that linear advantage 
distillation can succeed in increasing the threshold for more than 2 encoded bits 
with large blocks, but the details of the numerical results give strong hints that 
RCAD is the best linear advantage distillation scheme. 
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Appendix A 



Connection with Maurer's 
original advantage distillation 

In the original advantage distillation proposal by Maurer [Mau93] Alice randomly 
selects a codeword c s from an error correcting code (ECC), and sends m := c©dyv 
to Bob (and Eve) over the public channel, where the addition is bitwise modulo 2. 
Bob accepts the received word only if he can make a very reliable decision about the 
codeword sent my Alice. In practice, advantage distillation has often been limited 
to the case when the ECC is a repetition code and Bob only accepts if m © de is 
a valid codeword without errors [CF06, ABB + 06, BA07, KBR07]. In our approach 
we consider the more general case where the ECC is a binary linear code and Bob 
still accepts only if he detects no errors. 

We now want to show that announcing m := c © dA reveals exactly the same 
information as announcing a = HdA, the parities of the data as defined by the 
parity check matrix H. The equivalence can be seen as a specialization of the 
following lemma. 

Lemma 33. Let Alice have an n-bit string d, and a k-bit string r. Consider a (n, k) 
linear error correcting code with a (n — k) xn parity check matrix H and code words 
00...0 indexed by the k-bit binary strings. The following two announcements 
reveal the same information about d and r: 

1. Announce r and a where 

a = Hd. (A.l) 

2. Let cj be the codeword that gives cj © d the lowest numerical value when inter- 
preted as a binary number. Announce m := c r © cj © d. 

Proof. We first show that given m, we may compute a and r. Since He = for 
any valid codeword c, we have Hm = Hc r © Hcj © Hd = a. We can now compute 
all the 2 k possible dj compatible with Hdj = a. Let do be the one with lowest 
numerical value. Since do = Cj©d, we have m = c r ©do and therefore c r = m©do- 
Since we know the codeword c r , we also know its index string r. 
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Next, we show that given r and a, we can compute m. Again, we let do be the 
solution to Hd = a which has lowest numerical value. Since cj is defined such that 
cj © d = do, we get m = c r © do, where both c r and do are known. □ 

For the purpose of advantage distillation, the /c-bit string r is chosen uniformly 
at random. In the original AD proposal, the announcement that is made is c s © d, 
where c s is chosen uniformly at random. If this choice is done by computing c s : = 
c r + cj, the choice of c s is still uniform as long as cj does not depend or r, and 
here it only depends on d. In our approach, the random string r is never actually 
generated and announced, but a public announcement of uncorrelated random data 
does not influence anyone's knowledge about the data that Alice and Bob will later 
use for generating a secret key. So with the exception that the original approach 
broadcasts k unrelated bits of randomness, the two descriptions of the advantage 
distillation process are equivalent. 



Appendix B 

Proofs of lemmas from 
chapter 9 



This appendix collects the proofs of the lemmas in chapter 9. The proofs are 
somewhat tedious, but not very deep, and the main line of arguments can be followed 
in the main text. 



B.l Proof of lemma 29 

The parity check matrix H used in any linear advantage distillation scheme can 
be converted into an equivalent one on systematic form H = [P|l]. When k = 2, 
the parity matrix is a (n — 2) x 2 matrix, so all the rows in P are one of the 3 
rows 01, 10, and 11 (any 00 rows would mean that the corresponding raw bits are 
publicly revealed, which means that it is reducible to a parity matrix with those 
rows removed, see section 7.4). The parity matrix is equivalent under permuting 
the rows so the generic form of the systematic parity check matrix is 

1 1 1 
1 1 1 



H 



1 1 

1 

1 

1 

1 



1 



(B.l) 



The parity check matrix is fully characterized by the number of different 2-bit strings 
in the parity matrix, mi, moi an d noi- Recall the form of the repetition code parity 
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check matrix from Eq. (7.2). In the special case that mi = this is already case 1 
in the lemma. The not last rows are then the repetition code parity check matrix 
on the second bit together with the last noi bits. The nio first rows is the same on 
bits 1 and from 3 to nio + 2. 

In the generic case, we have nil > 0. We can then add the first row of H to 
all the other rows that start with 11, if any. We then get the equivalent parity 
check matrix which is no longer on systematic form due to the 1 entries in the third 
column 

"111 



H 



nonsyst 



1 

1 

1 

1 

1 

1 



1 



1 



(B.2) 



If we start announcing parities from the bottom row, we first announce the repetition 
code advantage distillation information on the block consisting of bit 2 together with 
the last noi bits, then the same information on bit 1 together with the next nio 
bits, and then the same information on bits 3 to mi + 2- After this announcement, 
all but the first 3 bits can be discarded, since their values can anyway be inferred 
from the announcement and the first three bits. Finally, the first row specify that 
we announce the parity of those three bits. In other words, this is case 2 in the 
lemma. 

B.2 Proof of lemma 30 



On a general Bell-diagonal state, the state after repetition code advantage distilla- 
tion is characterized by the new eigenvalues from Eqs. (8.4a)-(8.4d). 

1 



(n) 
Pi 



((pi+PzT + iPl-PzT), 
((pi+Pz) n -(.Pl-PzT), 
((Px + PyT + (Px ~ PyT) , 
((Px + PyT ~ (Px ~ PyT) , 



(B.3a) 
(B.3b) 
(B.3c) 
(B.3d) 



where n is the block size and the state is normalized such that its trace is the success 
probability of the advantage distillation step. 
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The starting state with p x = p y = p z = (5 — \/5)/20, pi = 1 — p x — p y — p 2 
satisfies 

°o=log 2 ( 7 . )=0. (B.4) 

As shown in section 8.2, the value of this parameter after RCAD is D^; CAD = 
nDc = 0. The set of states with Dq = is those states that satisfy 

(PI -Pz) 2 = (PI +Pz)(Px+Py), (B.5) 

With the parameters we defined in Eqs. (4.90a)-(4.90d), 

ao = pi + p x + P y + Pz = I, (B.6a) 

oci =Pi-Px-P y +Pz, (B.6b) 

a 2 = V2(pi - Pz), (B.6c) 

a 3 = V2{p x - Py ). (B.6d) 

the Dc = condition translates into 

a\ + 2o| = al = 1 (B.7) 

which is the equation for an an ellipse with center in (ax, 02) = (0, 0), ai-semiaxis 
1, and ai2-semiaxis 1/4. This ellipse can be parametrized as 

ax = cos 9 (B.8a) 
a 2 = -^ sin (9 (B.8b) 

The initial state also has p x = p y and from Eqs. (B.3c)-(B.3d) we see that this 
property is also conserved after RCAD. Putting together p x = p y and pi +p x +p y + 
p z = 1 with Eqs. (B.6b)-(B.6c) and Eqs. (B.8a)-(B.8b), we get the parametrization 
(9.3a)-(9.3d) from the lemma. 

The next step is to verify the values for cos given in the lemma. It is straight- 
forward to insert cos 6 = ^ and sin 6 = \f\ — cos 2 6 = and verify that this gives 

the initial state from Eq. (9.1) with p = (5 — \/5)/20. For the state after RCAD, 
we rewrite Eqs. (B.3a)-(B.3d) in terms of ai and get 

(B.9a) 
(B.9b) 

(B.9c) 
(B.9d) 



(n) 
«0 = 


^((ao + ai) n + (ao-ai) n 


(n) 

a\ = 


^((ao + ai) n -(ao-ai) n 


(n) 




V2 


(3)"- 


(n) 




V2 
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For the starting state, we have ao = 1 and a\ = 1 — 4p = l/y/b. For blocksize n we 
then have 

a[ n) (a + «i) n + («o - «i) n 1 - x n 

COS0 = —r^r = -. r -; 7— = (B.10) 

a W (a + ai) n + (a -ai) n 1 + x n 

for x = (3 — \/5)/2 ~ 0.38 < 1. Inserting n = 2 and n = 3 gives cos# = ^ and 
cos# = -J=, respectively. We also note that (1 — x n )/(l + x n ) increases when n 

increases for < x < 1 , so for n > 3 we will have cos 9 > -7= . 

B.3 Proof of lemma 31 

The indices of the eigenvalues indicate which error pattern would result in the 
corresponding eigenvector, e.g. pi yx indicates no error on qubit B\, a o y on qubit 
B2, and a a x on qubit B3. We assume that all errors happen on Bob's side and 
regard Alice's outcomes as correct. We can split the errors into bit errors and phase 
errors. A a x is a bit error without a phase error, a y is both bit and phase error, 
and a z is a phase error without a bit error. 

Following the implementation in section 7.5, Alice and Bob could use the circuit 



^5 
□ 

to implement the measurement corresponding to the parity check matrix [l 1 l] , 
on their three qubits, so that the qubits A3 and B3 are measured while A\, A2, B\, 
and B2 remain. Bit errors propagate from the two left qubits B\ and B2 to the right 
qubit -B3 that is subsequently measured and phase errors propagate from B3 to both 
B\ and B2. There are four ways of ending up with any specific error pattern on 
B\ and B2 — one for each possible Pauli error on B3. Two of those possibilities will 
leave a bit error on B3 before measurement. In that case the remaining qubits will 
be discarded, so only two of the error possibilities on B3 give rise to any specific 
error pattern on B\ and B2 after postselection. For example, in order to have 
no errors on the two left qubits before the measurement, the four possibilities are 

jBi (g, t B 2 (g, 1 B 3) jBi (g, jB 2 (g, cr i?3 ) o-Bi (g, a B 2 <g a B 3 ^ and ^ ^ a B 2 (g a B^ which 

has the probability puj + pn x + p zzy + p Z zz- However, in the cases where there is 
a bit error {a x or a y ) on B3, it will stay there since there is an even number of bit 
errors (i.e. 0) on B\ and B2, so the probability that there are no bit- or phase errors 
and the postselection succeeds is pfj = pm + p zzz . The pattern is the same for 
all output probabilities that have an even number of bit errors, p° ut = pijj + p m nz, 
where (m, n) has the same bit error pattern as are, but the opposite phase error 
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pattern. For output probabilities with an odd number of bit errors, the pattern is 
similar, only that / on qubit B% is swapped with x and z is swapped with y, i.e. 
there must be a pre-existing bit error on B% for it to have no bit error after the 
CNOTs so that it survives postselection. This gives the relations that are given in 
the lemma. 



B.4 Proof of lemma 32 

As already mentioned in section 7.5, the states after linear advantage distillation 
are still multi-qubit Bell-diagonal. This means that the state is invariant under 
a x ® o x and a z ® o z on each qubit pair. In this case we have only two qubit-pairs. 
On each side we define the new basis |0)i oca i := 1 00), |l)i OC ai := 1 01) , |2)i oca i := |10), 
and |3)i oca j := |11) and the operators X\ := a x <g) 1, X 2 := 1 ® cr x , Z\ := a z (g) 1, 
and Z 2 := 1 <8> o z . On the local 4-dimensional system, the two-qubit operators can 
be expressed as 

X 1 = |2)(0| + |3> <1| + |0)<2| + |1)(3|, (B.lla) 
X 2 = 1 1> <0| + |0)(1| + |3)<2| + |2)(3|, (B.llb) 
Zi = |0)(0| + |l)(l|-|2)(2|-|3)(3|, (B.llc) 
Z 2 = |0> <0| - |1)(1| + |2)(2| - |3)(3|. (B.lld) 

The state is invariant under Z\ ® Z\ and Z 2 <8> Z 2 . Each of these two operators 
splits the 16-dimensional Hilbert space into an 8-dimensional positive eigenspace 
and an 8-dimensional negative eigenspace, so there are 4 joint eigenspaces: (++) 
eigenspace spanned by 1 00) , |11), |22), and 1 33) , (H — ) spanned by 1 01) , |10), |23), and 

1 32), (-+) spanned by |02), 1 13) , |20), and |31), and ( ) spanned by |03), |12), |21), 

and 1 30). Since any vector which is not on one of these joint eigenspaces will be 
changed by applying Z\ (g) Z\ or Z 2 (g) Z 2 , the invariant density matrix will be a 
direct sum of operators on these 4-dimensional subspaces. 

The state is also invariant under X\§t>X\ and X 2 (&X 2 . These operations take a 
matrix element on one of the joint eigenspaces into another matrix element on the 
same joint eigenspace. The matrix elements therefore have to be equal. This gives 
the following equality relations on each of the joint eigenspaces. 



P00,00 = Pll.ll = P22.22 = /033,33 = \{pil + Pzl + Viz + Pzz) (B.12a) 

P00,H = Pll.OO = P22.33 = /533,22 = \ {PlI + Pzl ~ Viz ~ Pzz) (B.12b) 

/000,22 = Pll,33 = P22.00 = P33.ll = \ {PlI ~ Pzl + Plz ~ Pzz) (B.12c) 

P00,33 = Pll,22 = P22.ll = P33,00 = \{PlI ~ Pzl ~ Plz + Pzz) (B.12d) 
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(B.12e) 
(B.12f) 
(B.12g) 
(B.12h) 

(B.12i) 
(B.12j) 
(B.12k) 
(B.121) 

(B.12m) 
(B.12n) 
(B.12o) 
(B.12p) 

The joint eigenspaces are subspaces with no bit errors, bit error on first qubit, bit 
error on second qubit, and bit error on both qubits, respectively. The relation to the 
eigenvalues are also given by Eqs. (B.12a)-(B.12p). We can use the relations (9.6a)- 
(9.6p) from lemma 31 and the fact that pijk is a product distribution, pijk = qiVjSk 
to write the eigenvalues in terms of the eigenvalues of the three original Bell-diagonal 
states. That gives us 

Poo.oo = Pil.il = P22.22 = P33.33 = \{qi + Qz)(ri + r z )(si + s z ) (B.13a) 
P0Q.il = Pn.oo = P22.33 = P33.22 = \{qi + q z ){ri - r z ){si - s z ) (B.13b) 

P00.22 = Pll,33 = P22.00 = P33.ll = \{qi ~ q Z ){ri + T z )(si - S z ) (B.13c) 

Poo,33 = Pn,22 = P22,ii = P33.00 = \{qi ~ Qz){n - r z )(s I + s z ) (B.13d) 



P02.02 


= P13.13 


= P20.20 


= P31.31 = 


\{PxI + Pyl + Pxz +Pyz) 


P02.13 


= P13.02 


= P20.31 


= P31.20 = 


\{PxI+PyI - Pxz - Pyz) 


P02.20 


= P13.31 


= P20.02 


= P31.13 = 


\{PxI ~ Pyl + Pxz ~ Pyz) 


P02.31 


= P13.20 


= P20.13 


= P31.02 = 


\{PxI - Pyl - Pxz + Pyz) 


P01.01 


= PlO.10 


= P23.23 


= P32.32 = 


\ (Pix + Pzx + Ply + Pzy) 


POl.10 


= PlO.Ol 


= P23.32 


= P32.23 = 


'■ \{Plx + Pzx ~ Ply ~ Pzy) 


P01.23 


= PlO.32 


= P23.01 


= P32.10 = 


\ (Pix - Pzx + Ply - Pzy) 


P01.32 


= PlO.23 


= P23.10 


= P32.01 = 


: \{Plx ~ Pzx ~ Ply + Pzy) 


P03.03 : 


= P12.12 : 


= P21.21 : 


= P30.30 = 


~^(Pxx ~i~ Pyx ~i~ Pxy ~i~ Pyy) 


P03.12 : 


= P12.03 : 


= P21.30 : 


= P30.21 = 


^{Pxx ~i~ Pyx Pxy Pyy) 


P03.21 : 


= P12.30 : 


= P21.03 : 


= P30.12 = 


4 iPxx Pyx ~\~ Pxy Pyy ) 


P03.30 : 


= P12.21 : 


= P21.12 : 


= P30.03 = 


4 (jpxx Pyx Pxy ~\~ Pyy ) 



P02.02 


= P13.13 


= P20.20 


= P31.31 = 


\(lx 


P02.13 


= P13.02 


= P20.31 


= P31.20 = 


\{lx 


P02.20 


= P13.31 


= P20.02 


= P31.13 = 


\{lx 


P02.31 


= P13.20 


= P20.13 


= P31.02 = 


\{lx 


Poi.oi 


= PlO.10 


= P23.23 


= P32.32 = 


l M 


Poi.io 


= PlO.Ol 


= P23.32 


= P32.23 = 




P01.23 


= PlO.32 


= P23.01 


= P32.10 = 




P01.32 


= PlO.23 


= P23.10 


= P32.01 = 





+ q y ){ri + r z )(s x + s y ) (B.13e) 

+ q y )(ri ~ r z )(s x - s y ) (B.13f) 

- q y )(ri + r z ){s x - s y ) (B.13g) 

- q y ){ri -r z )(s x + s y ) (B.13h) 

+ q z )(r x + r y )(s x + s y ) (B.13i) 

+ q z ){r x - r y )(s x - Sy) (B.13j) 

- q z )(r x + r y )(s x - s y ) (B.13k) 

- q z ){r x - r y )(s x + Sy) (B.131) 
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P03.03 


= Pl2,12 


= P21,21 


P03,12 


= Pl2,03 


= P21,30 


P03,21 


= Pl2,30 


= /?21,03 


P03,30 


= Pl2,21 


= P21,12 



330,30 =\{qx + Qy)(rx+r y )(si + s z ) (B.13m) 

330,21 = l(q x + Qy)( r x ~ r y ){si - s z ) (B.13n) 

330,12 = \{q x - Qy)(rx+r y )(s I - s g ) (B.13o) 

330,03 = \{Qx- q y )(r x ~ r y )(si + s z ) (B.13p) 

Now we can insert the form of the states before the last announced bit (from 
lemma 30 with different angles) 

qi + qz = x(l + cos0), 77 + r z = -(1 + cos0), sj + s z = -(1 + cosa), 
qi-qz = -sm0, n-r z = - sin0, si - s z = -sma, 



111 

q y = -(1 -cos0), r x + r y = -(1 - cos0), Sa . + St , = -( 

<??, = 0, r x -r y = 0, s x - s y = 0. 



This gives zero for the matrix elements that have (q x — q y ), (r x — r y ), or (s x — s y ) 
in their expression. The other matrix elements are given by the expressions in the 
lemma. 
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Appendix C 



Sketch of generalized 
calculation for two encoded bits 

In chapter 8 we assumed that our starting state was any Bell-diagonal state on 
the threshold where the a secret key could no longer be distilled using RCAD. We 
showed that after RCAD, the states always had a symmetric extension. In chapter 
9, when considering LAD with two encoded bits, we restricted the starting state 
to being an isotropic state on the threshold. This is fine for the six-state protocol 
where the error parameter is the average QBER in the three bases (see section 
2.2.7). However, when the QBER in each basis is recorded in the six-state protocol 
or in the BB84 protocol where one parameter of the Bell-diagonal state has to be 
optimized over, the appropriate starting state cannot be assumed to be of this form. 

An analogue calculation to the one in in chapter 9 can be done without the 
assumption of the isotropic starting state. Only at the last step where we give 
analytic parameters for the simplified problem does this more general approach 
result in a more difficult problem. In this appendix, we sketch how the calculation 
analogue to the one in chapter 9 goes when we do not assume an isotropic starting 
state. 



C.l Reduction to starting state on the symmetric sub- 
space 

The main advantage of using an isotropic starting state was that it satisfies p x = p y 
(i.e. it is invariant under Sft ® S) and that this property also holds for the state 
after RCAD. This state can therefore be parametrized by a single parameter, which 
depends only on the blocksize used in the RCAD step. Instead, we here show that it 
is sufficient to start with states that satisfy p y = 0, which means that their support 
is on the symmetric subspace, PabR AB = p AB ■ 
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We now assume that our starting state is any Bell-diagonal state, 

P = PI \$ + )($ + \ + Px \y+)(y+\ +p v |*-)(*-|+p z |*-)(*-|, (C.l) 

which satisfies Dc = (see section 8.2), which means that 

{Pl-Pzf = (pi+Pz)(Px+Py)- (C.2) 

Recall from lemma 29 that linear advantage distillation steps with two encoded 
bits can be implemented by first performing RCAD on three subblocks followed by 
an announcement of the parity of the resulting bits. In section 8.2 we showed that 
the state after RCAD also satisfies Dq = when the original state does. Any state 
on the Dc = border satisfy 

Pl = \(l + cos6 + smO), (C.3a) 
Px+Py = cos 0) (C.3b) 

Pz = i(l + cos0-sin6>), (C.3c) 

which is similar to lemma 30, but p x —p y can be anything between —^(1 — cos 9) and 
|(1 — cos#) (corresponding to p x = and p y = 0, respectively). We can write any 
such state as a convex combination of one that has p x = and one that has p y = 
(which is why we only needed to verify that we always had a symmetric extension for 
those states in section 8.3). This means that the final state is a convex combination 
of the eight states we get by choosing p x = or p y = in each of the three qubit 
pairs before announcing the final parity. These states are all connected by local 
unitary operators. Therefore, if one of the states has a symmetric extension, then 
they all have one and any convex combination also has one. It is therefore sufficient 
to construct a symmetric extension for the state that we get by starting with three 
copies of the state with p y = and announcing the parity of the three bits. Instead 
of Eqs. (9.3a)-(9.3d) from lemma 30 we then get that the form of the Bell-diagonal 
state after RCAD is 



PI = 1(1 + cos(9 + sin6»), (C.4a) 

Pa. = |(1 -cose), (C.4b) 

Py = 0, (C.4c) 

p z = i(l + cos#-sin#). (C.4d) 



From Eqs (9.6a)-(9.6p) in lemma 31 we can see that when there is zero prob- 
ability of having a a y error on any of the three pairs in the starting state, all p°"* 
where one of i and j (but not both) are y also become zero. The vanishing terms are 
exactly those that have an eigenvector on the antisymmetric subspace, so the re- 
sulting state is supported only on the symmetric subspace (the eigenvector |\I' -, I'~) 
corresponding to the eigenvalue pt^f is on the symmetric subspace, since each |\E' - ) 
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is antisymmetric and both subsystems pick up a minus sign upon swapping A and 
B). 

Similar to Eqs (9.8a)-(9.8g) in lemma 32, we can write down the nonzero ele- 
ments of the density operator parametrized by three angles, 

Poo.oo = pn.ii = P22.22 = P33,33 = + cos0)(l + cos^)(l + cos a) (C.5a) 

Poo.n = /°n,oo = P22.33 = £33,22 = ~(1 + cos 0) sin (f> sin a (C.5b) 

Poo,22 = Pn,33 = P22,oo = P33,n = ^ sin 0(1 + cos <j>) sin a (C.5c) 

Poo,33 = 011,22 = P22,ii = P33,oo = ^ sin sin 0(1 + cos a) (C.5d) 



P01,01 = P10.10 = P23.23 = P32,32 = ~(1 + COS0)(1 - COS0)(1 - COS Ol) (C.5e) 

POl.10 = P10.01 = P23.32 = P32,23 = 7^(1 + COS(9)(l - COS0)(1 - COS a) (C.5f) 

P01,23 = Pl0,32 = P23.01 = P32,10 = g^ 5 ™^ 1 ~ COS<p)(l - COS a) (C.5g) 

P01,32 = Pl0,23 = P23.10 = P32,01 = — Sin0(l ~ COS </>)(! - COS a) (C.5h) 



P02,02 


= Pl3,13 


= P20,20 


= P31.31 = 


i(i 

32 v 


— cos 0)(1 + cos 4>)(1 — cos a) 


(C.5i) 


P02,20 


= Pl3,31 


= P20,02 


= P31.13 = 


Id 

32 v 


— cos 9)(1 + cos 4>){\ — cos a) 


(C5j) 


P02.13 


= Pl3,02 


= P20,31 


= P31.20 = 


la 

32 v 


— cos 9) sin 4>{1 — cos a) 


(C.5k) 


P02,31 


= P13.20 


= P20,13 


= P31.02 = 


Id 

32 v 


— cos 9) sin 4>{1 — cos a) 


(C.51) 



P03,03 


= P12.12 


= P21.21 


= P30.30 = 


l(i 

32 v 


- COS0)(1 


— cos 4>)(1 + cos a 


P03,30 


= P12.21 


= P21.12 


= P30,03 = 


Id 

32 v 


-cos0)(l 


— cos 4>)(1 + cos a 


P03.12 


= P12.03 


= P21.30 


= P30.21 = 


Id 

32 v 


- COS0)(1 


— cos 4>) sin a 


P03,21 


= Pl2,30 


= P21,03 


= P30.12 = 


la 

32 v 


-cos 9) (1 


— cos 4>) sin a 



(C.5o) 
(C.5p) 

Unlike the situation for an isotropic starting state, the only vanishing matrix ele- 
ments are those that have to vanish because of the Bell-diagonal form of the state. 
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C.2 Simplifying the symmetric extension problem 



As argued in section 9.2, the Bell-diagonal form of the states implies that we 
only need to construct the symmetric extension on the intersection of the posi- 
tive eigenspaces of a Ai <S> crf i <g> <r 2 % spanned by the vectors listed in Eq. (9.9). The 
resulting matrix with the constraints is illustrated in figure 9.1 on page 120, and is 
the same as for the case with isotropic starting state, except that in this case the 
circular symbols do not represent constraints that sum to zero. 

Since we cannot in this case set most of the off-diagonal matrix elements to 
zero, it looks harder to simplify this matrix. However, since the state p AB resides 
on the symmetric subspace, we are guaranteed that if a symmetric extension exist, 
also a symmetric extension on the fully symmetric subspace exist. This means that 
PabP ABB ' = Pab'P ABB ' = Pbb'P ABB ' = p ABB ' . The one-sided swap operator 
swaps only the rows in p ABB . The last six rows of the matrix correspond to the 
vectors 1 123) , 1 231 } , 1 312} , 1 132) , 1 213) , 1 321) and the three swap operators will 
swap different pairs of rows such that all the six last rows have to be equal. Since 
the matrix is Hermitian, the last six columns also have to be equal. Similarly, the 
tuple of vectors (|110), |220), |330>) can be changed into both (|101), |202), |303)) 
and (| 01 1) , 1 022) , 1 033)) , so all the 3x3 blocks in rows and columns 2-10 must be 
equal. In total, this symmetry means that the 16 x 16 matrix must have the form 
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(C.6) 

where M 3 is a 3 x 3 matrix. This matrix is positive semidefinite if and only if the 
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5x5 matrix on the subspace spanned by 1 000) , 1 110) , 1 220) , 1 330) , and 1 123) , 





" B 


a 


b 


c 


s 




a 








h 


M 5 = 


b 




M 3 




k 2 




c 








k 3 




s 


h 


k 2 


h 


t 



(C.7) 



is positive semidefinite. When the constraints on the 16 x 16 matrix is translated 
to the condensed matrix M5, they can be represented as 






9 




* 






(OA) 


* 




ki 


* 


* 


(Ov) 




k 2 


* 


* 




(❖□) 


k 3 






k 2 


k 3 


(A V □) 



(C.8) 



The parameters k±,k 2 , and k 3 are fixed by the constraints, 

k\ = — - sin 9(1 — cos <p)(l — cos a), 
128 
1 

k 2 = — - (1 — cos 9) sin 0(1 — cos a) , 
128 

&3 = 7x^(1 — cos 9)(1 — cos 0) sin a. 
128 

The other constraints on this subspace are 



(C.9a) 
(C.9b) 
(C.9c) 



POOO.OOO + P110,110 + /O220,220 + P330,330 = ^(1 + COS0)(1 + COS0)(1 + COS a), (0) 

Pooo,no + Pno.ooo + P220.330 + P330.220 = ^ (1 + cos 6) sin <f> sin a, (^) 

Pooo,220 + /Ono,330 + /5220,ooo + P330,iio = ^ sin 9(1 + cos 4>) sin a, (4) 

Pooo,330 + Piio,220 + p 22 o,no + P330,ooo = ^ sin 6» sin 0(1 + cos a), (4) 

PllO.HO + P123.123 = 77t(1 + COS0)(1 - COS0)(l - COSa), (A') 

54 

P220.220 + P123.123 = - cos6>)(l + COS0)(1 - cosa), (v') 
64 

/0330.330 + Pl23,123 = 77t(1 ~ COS0)(1 - COS0)(1 + COS«). (□') 

64 



The difference from the constraints on page 122 is the three last constraints, (a')- 
(□'). In this case, the matrix element t = /0i23,i23 cannot be any nonnegative value 
including zero, since the the elements k\ = pon, 123,^2 = Po 22 ,U3, and fc 3 = ,0033,123 
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are strictly positive. In practice, pi23,i23 can be small enough that this does not 
change the difficulty of fulfilling the constraints. The main difference is that the sum 
in these constraints is only half of what it was in chapter 9. This comes about since 
the matrix elements /Oioi,ioi> P202,202> and P303,303 no longer be can set to zero, since 
on the fully symmetric subspace these elements are equal to pno,no> P220,220> an d 
y°330,330] respectively. Since these constraints are on the diagonal matrix elements, 
this limits our possibility to choose a positive semidefinite 5x5 matrix of a nice 
form. 

C.3 Finding an explicit symmetric extension 

Even though we have reduced the problem to a 5 x 5 matrix with very similar 
constraints to the ones we were able to fulfill on the 4x4 matrix in section 9.3, 
we have found no analytical parametrization that fulfills the linear constraints and 
yet have a nice enough form that positivity can be shown. Still, we have found 
a procedure that will produce a matrix that fulfills the linear constraints and has 
produced a positive semidefinite matrix for the values of the parameters 9, (ft, a that 
we have tested. Unfortunately, the procedure does not allow the matrix elements 
to be expressed as an analytical function of 9, (ft, and a. The construction and 
verification of positivity has therefore only been done numerically. The procedure 
expresses the matrix as 



where D is a diagonal matrix and from this form it is evident that M5 is positive 
semidefinite if the matrix elements of D are nonnegative. The procedure is the 
following. 

Step 1 Set t = pi23,i23 := (1 — cos#)(l — cos</>)(l — cosa)/64. 
Step 2 Construct the column vector 



where ki,k2, and k% are fixed by the constraints. The matrix \ifti)(ifti\ now 
has the final values for the last row and column, so IV^XV^I an d D will have 
in those elements. 

Step 3 Construct a column vector with nonnegative elements 



m 5 = IViX^il + \ihHH + D 



(CIO) 



|^i) := {0,k 1 /Vt,k 2 /Vi,k 3 /Vi,Vi) 
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which fulfill 



B 



1 

64 



'2(1 + cos0)(l + cos0)(l + cosa) 



— (1 — cos 9)(1 + cos 0)(1 + cos a) 

— (1 + cos 9)(1 — cos cj))(l + cos a) 

— (1 + cos 9)(1 + cos <p)(l — cos a) 
+ 3(1 — cos0)(l — cos0)(l — cos a)], 



Bv\ + u 2 U3 
Bv 3 + 



1 

64 
1 

64 
1 

64 



(1 + cos 9) sin 4> sin a 
sin 0(1 + cos 4>) sin a 



sin 9 sin </>(! + cos a) 



t 

M^3 

t 

^2^3 
t 



(C.ll) 

(C.12) 
(C.13) 
(C.14) 



This value of -B ensures that when pno,iiO) P220,220i and ^330,330 take values 
such that the diagonal constraints (A')"(n') are satisfied, then also the diag- 
onal constraint (0) is satisfied. The other conditions are such that + 
IV^KV^I satisfies the off-diagonal constraints (9?), (♦), and (Jit). 

Step 4 Construct a diagonal matrix D := diag(0, d±, d,2, c?3, 0) where the three 
parameters are chosen such that the constraints (a')-(D') are satisfied by 
M5 = \ipi){ipi\ + IV^KV^I +D. If the three matrix elements d±, d,2, and ^3 are 
nonnegative, the matrix M5 is positive semidefinite. 

The part of this construction that cannot be done analytically is step 3. Solving 
for any of the unknown vi here gives an 8th order equation. However, it is easy to 
construct I^KV^I numerically by iteration. Start with the matrix 



B r s t 0" 

r 

s 

t 





(C.15) 



where ro, so, and to are the shorthand for the RHS of Eqs. (C.12), (C.13), and 
(C.14). This matrix satisfies the linear constraints given by Eqs (C.12), (C.13), and 
(C.14), but it is not of rank one. Next step is to update rows and columns 2-4 so 
that the matrix becomes of rank one. This gives 



B 
ro 
So 
to 




rl/B 
r s /B 
roto/B 




so 
r s /B 
sl/B 
s t /B 




to 

roto/B 
s t /B 
4/B 




(C.16) 
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This matrix is rank one, but does not fulfill the constraints. The constraints can be 
fulfilled again my updating the first row and column to get 



(C.17) 



This is the first correction to the original matrix. From this, the rows and columns 
2-4 can be replaced with the values that give a rank-one matrix and the first row 
and column can be updated to fulfill the constraints again. This gives the iteration 
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Typically, B is significantly larger than the parameters r, s, and t, so the iteration 
converges quickly. The resulting matrix, 
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(C.21) 



is both rank one and fulfills the constraints. 

If we had had analytical expressions for , Sqo , and too , we would also be able to 
find analytical expressions for d\, cfo, and d^. By asking when those expressions are 
nonnegative, we would have had three analytical inequalities which when fulfilled 
would guarantee that we had a symmetric extension. It is possible that some other 
construction may give a provably positive semidefinite M5, but it seems that the 
constraints do not leave us as much freedom as we might need to allow for a simple 
construction. 
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